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Part I 
Theoretical Performance 
of Error-Correcting Codes 


This part of the book deals with the theoretical performance of error-correcting codes. 
Upper and lower bounds are given for the achievable performance of error-correcting 
codes for the additive white Gaussian noise (AWGN) channel. Also given are bounds 
on constructions of error-correcting codes in terms of normalised minimum distance 
and code rate. Differences between ideal soft decision decoding and hard decision 
decoding are also explored. The results from the numerical evaluation of several 
different code examples are compared to the theoretical bounds with some interesting 
conclusions. 


Chapter 1 
Bounds оп Error-Correction Coding 
Performance 


11 Gallager’s Coding Theorem 


The sphere packing bound by Shannon [18] provides a lower bound to the frame 
error rate (FER) achievable by an (и, k, d) code but is not directly applicable to 
binary codes. Gallager [4] presented his coding theorem for the average FER for 
the ensemble of all random binary (и, k, d) codes. There are 2” possible binary 
combinations for each codeword which in terms of the n-dimensional signal space 
hypercube corresponds to one vertex taken from 2" possible vertices. There are 
2* codewords, and therefore 2"* different possible random codes. The receiver is 
considered to be composed of 2* matched filters, one for each codeword and a 
decoder error occurs if any of the matched filter receivers has a larger output than 
the matched filter receiver corresponding to the transmitted codeword. Consider this 
matched filter receiver and another different matched filter receiver, and assume that 
the two codewords differ in d bit positions. The Hamming distance between the two 
codewords is d. The energy per transmitted bitis E, — EE b, where E, is the energy 
per information bit. The noise variance per matched filtered received bit, o? — м, 
where No is the single sided noise spectral density. In the absence of noise, the output 
of the matched filter receiver for the transmitted codeword is n4/ E, and the output 
of the other codeword matched filter receiver is (n — 2d)4/ E,. The noise voltage at 
the output of the matched filter receiver for the transmitted codeword is denoted as 
n, — Ny, and the noise voltage at the output of the other matched filter receiver will 
ben, + nı. The common noise voltage n, arises from correlation of the bits common 
to both codewords with the received noise and the noise voltages —n, and n, arise, 
respectively, from correlation of the other d bits with the received noise. A decoder 
error occurs if 


(n—2d)/E,;+ne+n, > пу Е; + пе = п (1.1) 
that is, a decoder error occurs when 2n; > 24. / Е;. 
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The average noise power associated with n; is do? — а% and as the noise is 
Gaussian distributed, the probability of decoder error, pa, is given by 


n dx 1.2 
Ра = i (1.2) 


This may be expressed in terms of the complementary error function (erfc) 


erfe(y) = 2—— ІТ Ө ах (1.3) 


апа 


Ша gee (1.4) 
— —eric = $ 
ра = n No 


Each of the other 2“ — 2 codewords may also cause a decoder error but the weight 
distribution of the code & is usually unknown. However by averaging over all pos- 
sible random codes, knowledge of the weight distribution of a particular code is not 
required. The probability of two codewords of a randomly chosen code $5, differing 
in d bit positions, p(d|@;) is given by the binomial distribution 
(9 


р(44)- ae (1.5) 


where (5) = CE A given linear code @; cannot have codewords of arbitrary 
weight, because the sum of a subset of codewords is also a codeword. However, for 
non linear codes, pg may be averaged over all of the codes without this constraint. 
Thus, we have 


gnak n 2"® ЖЕ, 
pco D UOS FEE а ( км) (1.6) 


d=0 i=1 


Rearranging the order of summation 


_ gk E 
T- 0 (а а) T 


ізі 4-0 No 


= 1 x fn 
p < zx x). (1.8) 
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Remembering that any of ће 2“ — 1 matched filters may cause a decoder error, the 
overall probability of decoder error averaged over all possible binary codes Poverall, 18 


Poverall = 1- (1 = теу < 2*pc (1.9) 


pe 2% z n k Ep 
Poverall < PSI 2, "Ы |4” 3! (1.10) 


An analytic solution may be obtained by observing that тегіс( y) is upper bounded 


and 


by ету” and therefore, 


28 „7 аъ 
Рена = sx 4 (1.11) 


and as observed in [21], 


кау" п\ ах 
(1+е 4) x (je (1.12) 


4-0 
апа 
1 kE” 
Эс < x (15-6 4) (1.13) 
2k _k Ep T 
Poverall < 2n (1 Te ч) (1.14) 


Traditionally, a cut-off rate Ro is defined after observing that 
ЕГ п k 
= (1+е 4) =ž| = (1.15) 


with 


(1.16) 
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T T 
Gallager bound (128,64) 
Gallager bound (256,128) 
Gallager bound (512,256) 
Gallager bound (128,64), approx 
Gallager bound (256,128), approx 
Gallager bound (512,256), approx 


ошпжх+ 


FER 


Eb/No [dB] 


Fig. 1.1 Approximate and exact Gallager bounds for (128, 264), (256, 2128) and (512, 2256) non- 
linear binary codes 


then 
Poverall < 2-27-58 = gu = 2—"%-—) (1.17) 


This result may be interpreted as providing the number of information bits of the 
code is less than the length of the code times the cut-off rate, then the probability 
of decoder error will approach zero as the length of the code approaches infinity. 
Alternatively, provided the rate of the code, E is less than the cut-off rate, Ro, then the 
probability of decoder error will approach zero as the length of the code approaches 
infinity. The cut-off rate Ro, particularly in the period from the late 1950s to the 1970s 
was used as a practical measure of the code rate of an achievable error-correction 
system [11, 20—22]. However, plotting the exact expression for probability of decoder 
error, Eq. (1.10), in comparison to the cut-off rate approximation Eq. (1.17), shows а 
significant difference in performance, as shown in Fig. 1.1. The codes shown are the 
(128, 29^), (256, 212%) and (512, 2756) code ensembles of nonlinear, random binary 
codes. It is recommended that the exact expression, Eq. (1.10) be evaluated unless 
the code in question is a long code. As a consequence, in the following sections we 
shall only use the exact Gallager bound. 

Shown in Fig. 1.2 is the sphere packing lower bound, offset by the loss attributable 
to binary transmission and the Gallager upper bound for the (128, 294), (256, 2128) 
and (512, 2256) nonlinear binary codes. For each code, the exact Gallager upper 
bound given by (1.10), is shown. One reason why Gallager's bound is some way 
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Fig. 1.2 Sphere packing and Gallager bounds for (128, 264), (256, 2128) and (512, 2256) nonlinear 
binary codes 


from the sphere packing lower bound as shown in Fig. 1.2 is that the bound is based 
on the union bound and counts all error events as if these are independent. Except for 
orthogonal codes, this produces increasing inaccuracy as the A 18 reduced. Equiva- 
lently expressed, double counting is taking place since some codewords include the 
support of other codewords. It is shown in the next section that for linear codes the 
Gallager bound may be improved by considering the erasure correcting capability 
of codes, viz. no (n, k) code can correct more than n — k erasures. 


1.1.1 Linear Codes with a Binomial Weight Distribution 


The weight enumerator polynomial of a code is defined as A(z) which is given by 
АО = А2 (1.18) 


For many good and exceptional, linear, binary codes including algebraic and quasi- 
cyclic codes, the weight distributions of the codes closely approximates to a binomial 
distribution where, 
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upset У "ш (1.19) 
2n-k £o DN 


with coefficients A; given by 


in 1 n! _ 1 п (1.20) 
б nk (n= itil 2n Ni Jf. | 


Tables of the best-known linear codes have been published from time to time (3, 10, 
13, 16, 19] and a regularly updated database is maintained by Markus Grassl [5]. 
Remembering that for a linear code, the difference between any two codewords is 
also a codeword, and hence the distribution of the Hamming distances between a 
codeword and all other codewords is the same as the weight distribution of the code. 
Accordingly, the overall probability of decoder error, for the same system as before 
using a bank of 2% matched filters with each filter matched to a codeword is upper 


bounded by 
TP | k E, 
overa! = Ag fi а--- 1.21 
p 1732, es( tx) (1.21) 


For codes having a binomial weight distribution 


n 


1 1 fn k Е, 
overa! p fi а--- 1.22 
р 1 < 2 > 2n—k (‘er ( n 5) ( ) 


which becomes 


үп k Е, 
Poverall < Эп+1 2: "Ы E. x) . (1.23) 


It will be noticed that this equation is identical to Eq. (1.10). This leads to the some- 
what surprising conclusion that the decoder error probability performance of some 
of the best-known, linear, binary codes is the same as the average performance of the 
ensemble of all randomly chosen, binary nonlinear codes having the same values for 
n and k. Moreover, some of the nonlinear codes must have better performance than 
their average, and hence some nonlinear codes must be better than the best-known 
linear codes. 

A tighter upper bound than the Gallager bound may be obtained by considering 
the erasure correcting capability of the code. It is shown in Chap. 14 that for the 
erasure channel, given a probability of erasure, p, the probability of decoder error, 
Poe (p), is bounded by 
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= | — $)! п 
Peode(P) < > Y at = vo dp D prc piro. 


)! 
== dmin j= dmin TJ s=n—k+1 


(1.24) 


In Eq. (1.24), the first term depends upon the weight distribution of the code while 
the second term is independent of the code. The basic principle in the above equation 
is that an erasure decoder error is caused if an erasure pattern includes the support 
of a codeword. Since no erasure pattern can be corrected if it contains more than 
n — k errors, only codewords with weight less than or equal to n — k are involved. 
Consequently, a much tighter bound is obtained than a bound based on the union 
bound as there is less likelihood of double counting error events. 

Considering the maximum likelihood decoder consisting of a bank of correlators, 
a decoder error occurs if one correlator has a higher output than the correlator corre- 
sponding to the correct codeword where the two codewords differ in s bit positions. 
To the decoder, it makes no difference if the decoder error event is due to erasures, 
from the erasure channel, or Gaussian noise from the AWGN channel; the outcome is 
the same. For the erasure channel, the probability of this error event due to erasures, 


Р.тавше(р) 18 


Perasure CD) = p (1.25) 


E 
The probability of this error event due to noise, Phoise (55) is 


E, 1 k Ej 
Poise | — | = —erfe 5--- (1.26) 
No 2 n No 


Equating Eqs. (1.25) to (1.26), for these probabilities gives a relationship between 
the erasure probability, p and a and the Hamming distance, s. 


еле Е (1.27) 
Р =. 61a Е 


For many codes, the erasure decoding performance is determined by а narrow range 
of Hamming distances and the variation in x as a function of s is insignificant. This 
is illustrated in Fig. 1.3 which shows the variation in Ea as a function of s and p. 
Itis well known that the distance distribution for many linear, binary codes includ- 
ing BCH codes, Goppa codes, self-dual codes [7, 8, 10, 14] approximates to a bino- 


mial distribution. Accordingly, 


n! 


A; © ———___.. 1.28 
Ga pia г” 
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Fig. 1.3 xe as a function of Hamming distance s and erasure probability p 


Substituting this into Eq. (1.24) produces 


n—k n 
25 — ] fn 
Peode(P) < > ЕШ — py + > рер). (129) 
5-1 


s=n—k+1 


With the assumption of a binomial weight distribution, an upper bound may be 
determined for the erasure performance of any (и, k) code, and in turn, equating 
Eq. (1.25) with Eq. (1.26) produces an upper bound for the AWGN channel. For 
example, Fig. 1.4 shows an upper bound of the erasure decoding performance of a 
(128, 64) code with a binomial weight distribution. 

Using Eq. (1.27), the decoding performance may be expressed in terms of г 
and Fig. 1.5 shows the upper bound of the decoding performance of the same code 
against Gaussian noise, as a function of A 

The comparison of the sphere packing bound and the Gallager bounds is shown 
in Fig. 1.6. Also shown in Fig. 1.6 is the performance of the BCH (128, 64, 22) code 
evaluated using the modified Dorsch decoder. It can be seen from Fig. 1.6 that the 
erasure-based upper bound is very close to the sphere packing lower bound and 
tighter than the Gallager bound. 

Figure 1.7 gives the bounds for the (512, 256) and (256, 128) codes. It will be 
noticed that the gap between the sphere packing bound and the erasure-based upper 
bound increases with code length, but is tighter than the Gallager bound. 
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Fig. 1.4 Erasure decoding performance of a (128, 64) code with a binomial weight distribution 
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Fig.1.5 Decoding performance ofa (128, 64) code with a binomial weight distribution for Gaussian 
noise 
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Fig. 1.6 Comparison of sphere packing and Gallager bounds to the upper bound based on erasure 
performance for the (128, 64) code with a binomial weight distribution 
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Fig. 1.7 Comparison of sphere packing and Gallager bounds to the upper bound based on erasure 
performance for (256, 128) and (512, 256) codes with a binomial weight distribution 
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1.1.2 Covering Radius of Codes 


The covering radius of a code, c, if itis known, together with the weight spectrum of 
the low-weight codewords may be used to tighten the Union bound upper bound on 
decoder performance given by Eq. (1.23). The covering radius of a code is defined as 
the minimum radius which when placed around each codeword includes all possible 
q" vectors. Equivalently, the covering radius is the maximum number of hard decision 
errors that are correctable by the code. For a perfect code, such as the Hamming codes, 
the covering radius is equal to duis 1, For the [2" — 1, 2" — m — 1,3] Hamming 
codes, the covering radius is equal to 1 and for the (23, 12, 7) Golay code the covering 
radius is equal to 3. As a corollary, for any received vector in Euclidean space, there 
is always a codeword within a Euclidean distance of c, 4- 0.5. It follows that the 
summation in Eq. (1.23) may be limited to codewords of weight 2c, -- 1 to produce 


т k Ey 
оуега: ec IH f а--- . 1.30 
Poverall < этү 2. (‘er с LN (1.30) 


1.1.3 Usefulness of Bounds 


The usefulness of bounds may be realised from Fig. 1.8 which shows the performance 
of optimised codes and decoders all (512, 256) codes for a turbo code, LDPC code 
and a concatenated code. 


1.2 Bounds on the Construction of Error-Correcting Codes 


A code (linear or nonlinear), @, defined in a finite field of size 4 can be described with 
its length n, number of codewords! M and minimum distance d. We use (n, M, а у to 
denote these four important parameters of a code. Given any number of codes defined 
in a field of size 4 with the same length n and distance d, the code with the maximum 
number of codewords M is the most desirable. Equivalently, one may choose to fix 
n, M and q and maximise d or fix M, d and q and maximise n. As a result, it is of 
interest in coding theory to determine the maximum number of codewords possible 
of any code defined in a field of size q, with minimum distance d and length n. This 
number is denoted by A, (n, d). Bounds on A, (п, d) are indicators to the maximum 
performance achievable from any code with parameters (n, M, d),. As a result, 
these bounds are especially useful when one constructs good error-correcting codes. 
The tables in [5] contain the best-known upper and lower bounds on A, (n, d) for 
linear codes. The tables in [9] contain bounds on Аә(п, d) for nonlinear binary codes. 


'Where the code dimension k = log, M. 
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Fig. 1.8 Comparison of sphere packing, Gallager and erasure-based bounds to the performance 
realised for a (512, 256, 18) turbo code, (512, 256, 14) LDPC code and (512, 256, 32) concatenated 
code 


Lower bounds on A, (n, d) tend to be code specific; however, there are several generic 
upper bounds. As an example, consider the best-known upper and lower bounds on 
A5(128, d) obtained from the tables in [5]. These are shown in Fig. 1.9 for the range 
1 «x d < 128. Optimal codes of length n = 128 are codes whose lower and upper 
bounds on A5(128, d) coincide. The two curves coincide when k is small and d is 
large or vice versa. The gap between the upper and lower bounds that exists for other 
values of k and d suggests that one can construct good codes with a larger number of 
codewords and improve the lower bounds. An additional observation is that extended 
BCH codes count as some of the known codes with the most number of codewords. 

It is often useful to see the performance of codes as their code lengths become 
arbitrarily large. We define the information rate 


log, (A, (n, дп)) 


o4,(8) = lim — — — ———, (1.31) 
поо n 
where ó — 2 is called the relative distance. Since the dimension of the code is а 


ask = log, (А, (n, àn)), then a bound on the information rate o, (8) is a bound on К, 
аз п — oo. 
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Fig. 1.9 Upper and lower bounds on A2(128, d) 


1.2.1 Upper Bounds 


1.2.1.1 Sphere Packing (Hamming) Bound 


Let V, (n, t) represent the number of vectors in each sphere then, 


1 


V, (п, t) -Х(94- D. (1.32) 


i=0 


Theorem 1.1 (Sphere Packing Bound) The maximum number of codewords A, (n, а) 
is upper bounded by, 


n 


4 
Aq (п, d) < t 


> Ө 4-1 


i=0 


Proof А code @ is a subset of a vector space GF(q)". Each codeword of @ has only 
those vectors GF(q)" but not in @ lying at a hamming distance t = |41 from it 
since codewords are spaced at least d places apart. In other words, no codewords lie 
in a sphere of radius t around any codeword of @. As such, for counting purposes, 
these spheres can represent individual codewords. The Hamming bound counts the 
number of such non-overlapping spheres in the vector space GF(q)". 
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Codes that meet this bound are called perfect codes. In order to state the asymptotic 


sphere packing bound, we first define the gary entropy function, H, (x), for the values 
O<x<r, 


0 if x 20 
Н, (x) = А 
х log, (q — 1) — x log, x — (1 — x)log,(1 — х) if O<x<r 
(1.33) 
Theorem 1.2 (Asymptotic Sphere Packing Bound) The information rate of a code 


at, (8) is upper bounded by, 
6 
о4(5) < 1— Н, (5) 
2 
for the range0 < 8 < 1— 47!. 


1.2.4.2 Plotkin Bound 


Theorem 1.3 (Plotkin Bound) Provided d > 0n, where 0 — 1 — q then, 


A а < 4 
«(n d) = FE 


Proof Let S = У а(х, y) for all codewords x, y € @,andx Æ y, and d(x, y) denotes 
the hamming distance between codewords x and y. Assume that all the codewords 
of @ are arranged in an M x n matrix D. Since d(x, y) > а, 


jl 
= (M —2)! 


а= M(M — Dd. (1.34) 
Let n; бе the number of times an element о in the defining field of the code GF(q) 


occurs in the ith column of the matrix D. Then, >, nj, = M. For each п; „ there 


a €GF(q) 
are M — nj, entries of the matrix D in column i that have elements other than o. 


These entries are a hamming distance 1 from the n; « entries and there are n possible 
columns. Thus, 


A »3 hi4 (M — nig) 


ї=1 о««СЕ(4) 


=> MC mos (1.35) 


і=1 аєСЕ(4) 


1.2 Bounds on the Construction of Error-Correcting Codes 17 


From the Cauchy—Schwartz inequality, 


2 


>. ты] s4 X п (1.36) 


o €GF(q) o €GF(q) 


Equation (1.35) becomes, 


2 


$ nM Уа >) nia (1.37) 


i=l a€GF(q) 


Let 0 — 1— q7!, 


2 


S < nM? — Уа Ж 


i=l a€GF(q) 

<nM? — q nM? 

< n0M?. (1.38) 
Thus from (1.34) and (1.38) we have, 
M(M — 14 < S < пөм? (1.39) 
а 

М < 1.40 
~ E - x ( ) 


and clearly d > 0n. 


Corollary 1.1 (Asymptotic Plotkin Bound) The asymptotic Plotkin bound is given 
by, 


o, (8) = 0 if 6-8-1 


8 
а) 51-5 if 0<5 <9. 


1.2.1.3 Singleton Bound 


Theorem 1.4 (Singleton Bound) The maximum number of codewords A,(n, d) is 
upper bounded by, 
A nd) egt 
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Codes that meet this bound with equality, ie. d = n — k + 1, are called maxi- 
mum distance separable codes (MDS). The asymptotic Singleton bound is given 
Theorem 1.5. 


Theorem 1.5 (Asymptotic Singleton Bound) The information rate o, (8) is upper 
bounded by, 
a(n, ô) x 1 — 8. 


The asymptotic Singleton bound does not depend on the field size q and is a straight 
line with a negative slope in a plot of o, (8) against ô for every field. 


1.2.1.4 Elias Bound 


Another upper bound is the Elias bound [17]. This bound was discovered by P. Elias 
but was never published by the author. We only state the bound here as the proof is 
beyond the scope of this text. For a complete treatment see [6, 10]. 


Theorem 1.6 (Elias Bound) A code @ of length n with codewords having weight at 
most у, w < 0n with 0 = 1 — q^! has, 


"m Mw ( 2- w ) 
M-1 On 
Theorem 1.7 (Asymptotic Elias Bound) The information rate о4(6) is upper 


bounded by, 
a,(6) < 1 — H,(6 — J0(0 — 8)) 


provided 0 < 8 < Ө where0 = 1 — 47'. 


1.2.1.5 MRRW Bounds 


The McHliece-Rodemich-Rumsey-Welch (MRRW) bounds are asymptotic bounds 
obtained using linear programming. 


Theorem 1.8 (Asymptotic MRRW Bound I) Provided 0 <r < 0, 0 = 1 — q`! 


then, 
1 
“өн, (ža 1 — (q — 2)8 – 2у8(1— 8)(4 2) 


The second MRRW bound applies to the case when q — 2. 


Theorem 1.9 (MRRW Bound П) Provided 0 < 6 < 1 апа q = 2 then, 


(5) < min {1+ g(u’) — g(u? + 28и + 28)) 
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1—41- 
c= (I5). 


where 
2 


The MRRW bounds are the best-known upper bound on the information rate for the 
binary case. The MRRW-II bound is better than the MRRW-I bound when ô is small 
and q — 2. An in depth treatment and proofs of the bounds can be found in [12]. 


1.2.22 Lower Bounds 


1.2.21 — Gülbert-Varshamov Bound 


Theorem 1.10 (Gilbert-Varshamov Bound) The maximum number of codewords 
A, (n, d) is lower bounded by, 


q 
А„(п,а) > 
а(п те d 


eim -1 Ж M 
()«- v 
і-0 


Proof We know that V, (n, d - 1) represents the volume of a sphere centred оп а 
codeword of @ of radius d — 1. Suppose has A, (п, d) codewords. Every vector 
ve Е lies within a sphere of volume V, (n, d — 1) centred at a codeword of @ as 
such, 


Ag (n,d) 


U Si = [F7]. 
i=! 


where S; is a set containing all vectors in a sphere of radius d — 1 centred on a 
codeword of @. The spheres S; are not mutually disjoint. If we assume 5; are mutually 
disjoint then, 

Aq (n, d) V, (n, d — 1) > (Ел. 


Theorem 1.11 77e information rate of a code is lower bounded by, 
о4(8) > 1 — H4(8) 
for0x8x0,0—-1-q'. 
Figures 1.10 and 1.11 show the asymptotic upper and lower bounds for the cases 
where 4 = 2 and д = 32, respectively. Figure 1.11 shows that the MRRW bounds 


are the best-known upper bounds when q — 2. Observe that the Plotkin bound is the 
best upper bound for the case when q — 32. 
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Table 1.1 Ranges for codes Finite field Range 
Е 1<k<n< 256 
Ез 1< К < п < 243 
Ед 1<k<n< 256 
Fs 1<k<n< 130 
F7 1<k<n< 100 
Fg 1<k<n< 130 
Ғо 1<k<n< 130 


1.2.3 Lower Bounds from Code Tables 


Tables of best-known codes are maintained such that if a code defined in a field 4 
is constructed with an evaluated and verifiable minimum Hamming distance d that 
exceeds a previously best-known code with the same length n and dimension, the 
dimension of the new code is a lower bound on A, (п, d). The first catalogue of best- 
known codes was presented by Calabi and Myrvaagnes [2] containing binary codes 
of length n and dimension k in the range 1 < k <n < 24. Brouwer and Verhoeff [1] 
subsequently presented a comprehensive update to the tables which included codes 
with finite fields up to size 9 with the ranges for k and n. 

At present, Grassl [5] maintains a significantly updated version of the tables in [1]. 
The tables now contain codes with k and n in ranges from Table 1.1. Finally, Schimd 
and Shurer [15] provide an online database for optimal parameters of (f, m, s)- 
nets, (1, s)-sequences, orthogonal arrays, linear codes and ordered orthogonal arrays. 
These are relatively new tables and give the best-known codes up to finite fields of size 
256. The search for codes whose dimension exceeds the best-known lower bounds 
on A, (n, d) is an active area of research with the research community constantly 
finding improvements. 


13 Summary 


In this chapter we discussed the theoretical performance of binary codes for the 
additive white Gaussian noise (AWGN) channel. In particular the usefulness of Gal- 
lager's coding theorem for binary codes was explored. By assuming a binomial 
weight distribution for linear codes, it was shown that the decoder error probability 
performance of some of the best, known linear, binary codes is the same as the aver- 
age performance of the ensemble of all randomly chosen, binary nonlinear codes 
having the same length and dimension. Assuming a binomial weight distribution, an 
upper bound was determined for the erasure performance of any code, and it was 
shown that this can be translated into an upper bound for code performance in the 
AWGN channel. Different theoretical bounds on the construction of error-correction 
codes were discussed. For the purpose of constructing good error-correcting codes, 


22 


1 Bounds on Error-Correction Coding Performance 


theoretical upper bounds provide fundamental limits beyond which no improvement 
is possible. 
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Chapter 2 
Soft and Hard Decision Decoding 
Performance 


21 Introduction 


This chapter is concerned with the performance of binary codes under maximum 
likelihood soft decision decoding and maximum likelihood hard decision decoding. 
Maximum likelihood decoding gives the best performance possible for a code and 
is therefore used to assess the quality of the code. In practice, maximum likelihood 
decoding of codes is computationally difficult, and as such, theoretical bounds on 
the performance of codes are used instead. These bounds are in lower and upper 
form and the expected performance of the code is within the region bounded by the 
two. For hard decision decoding, lower and upper bounds on maximum likelihood 
decoding are computed using information on the coset weight leader distribution. 
For maximum likelihood soft decision decoding, the bounds are computed using the 
weight distribution of the codes. The union bound is a simple and well-known bound 
for the performance of codes under maximum likelihood soft decision decoding. 
The union bound can be expressed as both an upper and lower bound. Using these 
bounds, we see that as the SNR per bit becomes large the performance of the codes 
can be completely determined by the lower bound. However, this is not the case with 
the bounds on maximum likelihood hard decision decoding of codes. In general, soft 
decision decoding has better performance than hard decision decoding and being 
able to estimate the performance of codes under soft decision decoding is attractive. 
Computation of the union bound requires the knowledge of the weight distribution of 
the code. In Sect. 2.3.1, we use a binomial approximation for the weight distribution 
of codes for which the actual computation of the weight distribution is prohibitive. 
As a result, it possible to calculate within an acceptable degree of error the region in 
which the performance of codes can be completely predicted. 
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2.2 Hard Decision Performance 


2.2.1 Complete and Bounded Distance Decoding 


Hard decision decoding is concerned with decoding of the received sequence in 
hamming space. Typically, the real-valued received sequence is quantised using a 
threshold to a binary sequence. A bounded distance decoder is guaranteed to correct 
all 1 errors or less, where f is called the packing radius and is given by: 


F] 
t= | —— 

2 
and d is the minimum hamming distance of the code. Within a sphere centred 
around a codeword in the hamming space of radius 1 there is no other codeword, 
and the received sequence in this sphere is closest to the codeword. Beyond the 
packing radius, some error patterns may be corrected. A complete decoder exhaus- 
tively matches all codewords to the received sequence and selects the codeword with 
minimum hamming distance. A complete decoder is also called a minimum dis- 
tance decoder or maximum likelihood decoder. Thus, a complete decoder corrects 
some patterns of error beyond the packing radius. The complexity of implementing 
a complete decoder is known to be NP-complete [3]. Complete decoding can be 
accomplished using a standard array. In order to discuss standard array decoding, we 
first need to define cosets and coset leaders. 


Definition 2.1 А coset of a code @ is a set containing all the codewords of @ 
corrupted by a single sequence a € F7 \ € U {0}. 


A coset of a binary code contains 2* sequences and there are 2”~* possible cosets. 
Any sequence of minimum hamming weight in a coset can be chosen as a coset 
leader. In order to use a standard array, the coset leaders of all the cosets of a code 
must be known. We illustrate complete decoding with an example. Using a (7, 3) 
dual Hamming code with the following generator matrix 


1000111 
a = [0101011 
0011101 


This code has codewords 


-- онооно 
-о-- о-оо 
---о-ооо 
о-о--- оо 
оо-н- оно 
о--оо- о 
-ооо-- но 
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Coset Leaders 
0000000 1000111 0101011 0011101 1101100 0110110 1011010 1110001 


0000001 1000110 0101010 0011100 1101101 0110111 1011011 1110000 
0000010 1000101 0101001 0011111 1101110 0110100 1011000 1110011 
0000100 1000011 0101111 0011001 1101000 0110010 1011110 1110101 
0001000 1001111 0100011 0010101 1100100 0111110 1010010 1111001 
0010000 1010111 0111011 0001101 1111100 0111110 1001010 1100001 
0100000 1100111 0001011 0111101 1001100 0010110 1111010 1010001 
1000000 0000111 1101011 1011101 0101100 1110110 0011010 0110001 


0000011 1000100 0101000 0011110 1101111 0110101 1011001 1110010 
0000110 1000001 0101101 0011011 1101010 0110000 1011100 1110111 
0001100 1001011 0100111 0010001 1100000 0111010 1010110 1111101 
0011000 1011111 0110011 0000101 1110100 0101110 1000010 1101001 
0001010 1001101 0100001 0010111 1100110 0111100 1010000 1111011 
0010100 1010011 0111111 0001001 1111000 0100010 1001110 1100101 
0010010 1010101 0111001 0001111 1111110 0100100 1001000 1100011 
0001110 1001001 0100101 0010011 1100010 0111000 1010100 1111111 


Fig. 2.1 Standard array for the (7, 3, 4) binary code 


Complete decoding can be accomplished using standard array decoding. The example 
code is decoded using standard array decoding as follows, The top row of the array 
in Fig. 2.1 in bold contains the codewords of the (7, 3, 4) code.! Subsequent rows 
contain all the other cosets of the code with the array arranged so that the coset 
leaders are in the first column. The decoder finds the received sequence on a row 
in the array and then subtracts the coset leader corresponding to that row from it to 
obtain a decoded sequence. The standard array is partitioned based on the weight of 
the coset leaders. Received sequences on rows with coset leaders of weight less than 
or equal to t = зы = 1 are all corrected. Some received sequences on rows with 
coset leaders with weight greater than / are also corrected. Examining the standard 
array, it can be seen that the code can correct all single error sequences, some two 
error sequences and one three error sequence. The coset weight C; distribution is 


Со =1 
Due 
C=7 
Cri 


The covering radius of the code is the weight of the largest coset leader (in this 
example it is 3). 


‘It is worth noting that a code itself can be considered as a coset with the sequence a an all zero 
sequence. 
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2.2.2 The Performance of Codes on the Binary Symmetric 
Channel 


Consider a real-valued sequence received from a transmission through an AWGN 
channel. If a demodulator makes hard decisions at the receiver, the channel may be 
modelled as a binary symmetric channel. Assuming the probability of bit error for 
the BSC is p, the probability of decoding error with a bounded distance decoder is 
given by, 


Рврр(е) = 1 — > C; p/(1 — py Q.1) 
і-0 


where C; is the number of coset leaders with weight i. C; known for 0 < i < t and 
18 given by, 
с-(% O0<i<t. 
i 


However, C;, i > t need to be computed for individual codes. The probability of 
error after full decoding is 


Ра(е) = 1— > Cip (1 — py. Q2) 


i=0 


Figure2.2 shows the performance of the bounded distance decoder and the full 
decoder for different codes. The bounds are computed using (2.1) and (2.2). As 
expected, there is significant coding gain between unencoded and coded transmission 
(bounded distance and full decoding) for all the cases. There is a small coding gain 
between bounded distance and full decoders. This coding gain depends on the coset 
leader weight distribution C; for i > t of the individual codes. The balance between 
complexity and performance for full and bounded distance decoders” ensures that 
the latter are preferred in practice. Observe that in Fig. 2.2 that the complete decoder 
consistently outperforms the bounded distance decoder as the probability of error 
decreases and AL increases. We will see in Sect. 2.3 that a similar setup using soft 
decision decoding in Euclidean space produces different results. 


2.2.2.1 Bounds on Decoding on the BSC Channel 


Suppose s is such that С, is the maximum non-zero value for a code then s is the 
covering radius of the code. If the covering radius s of a code is known and C;, i > t 
are not known, then the probability of error after decoding can be bounded by 


7Bounded distance decoders usually have polynomial complexity, e.g. the Berlekamp Massey 
decoder for BCH codes has complexity O (t^) [1]. 
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Fig. 2.2 BCH code BDD and full decoder performance, frame error rate (FER) against S 

п 

Р, >21 |У )pid— py"! + pd py (2.3) 
i 

i=0 

{п 

=1- X (ра р)" -w,pac- pr (2.4) 
і-0 t 


assuming the code can correct 7 errors and 
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The lower bound assumes that there is a single coset leader of weight s, and hence 
the term p*(1 — p)" * while the upper bound assumes that all the coset leaders of 
weight greater than ¢ have weight equal to the covering radius s. For the lower bound 
to hold, W, > 1. The lower bound can be further tightened by assuming that the 
W, — 1 cosets have weight of t + 1, t + 2, ... until they can all be accounted for? 


2.3 Soft Decision Performance 


The union bound for the probability of sequence error using maximum likelihood 
soft decoding performance on binary codes with BPSK modulation in the AWGN 


channel is given by [2], 
Ев. 
j егіс —Rj (2:5) 
j=l No 


where R is the code rate, A ; is the number of codewords of weight j and M isthe SNR 
per bit. The union bound is obtained by assuming that events in which the received 
sequence is closer in euclidean distance to a codeword of weight j are independent 
as such the probability of error is the sum of all these events. A drawback to the 
exact computation of the union bound is the fact that the weight distribution Ау, 
0 < j < n of the code is required. Except for a small number of cases, the complete 
weight distribution of many codes is not known due to complexity limitations. Since 
A; -0іогі < j < d where d is the minimum distance of the code we can express 


(2.5) as, 
z A Aj ete | <i) (2.6) 
> Ал ЕТЕ |— Ra) +5 D3 Aj e | ri) (2.7) 
2. =d+1 


A lower bound on the probability of error can be obtained if it is assumed that error 
events occur only when the received sequence is closer in euclidean distance to 
codewords at a distance d from the correct codeword. 


Ep 
P, > 2 Agerfe{ | Ra (2.8) 
No 


3This can be viewed as the code only has one term at the covering radius, and all other terms are at 
4451, 


» 
а 


ІЛ 


NI] = 
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1 < Ey. 
= А; егіс —Rj | = 0. (2.9) 
2. No 
ј=а+1 
1 | Ep 1x | Eb... 
2 Ad «( тыш) <Р; < 5 2. Aj zi xu) (2.10) 


Therefore, the practical soft decision performance of a binary code lies between 
the upper and lower Union bound. It will be instructive to observe the union bound 
performance for actual codes using their computed weight distributions as the SNR 


per bit zi increases. By allowing ту " to become large (and P; to decrease) simulations 


for Saal codes suggest that at a — intersection value of M the upper bound 


equals the lower bound. Consider Figs. 2.3, 2.4 and 2.5 which show the frame error 
rate against the SNR per bit for three types of codes. The upper bounds in the figures 
are obtained using the complete weight distribution of the codes with Eq. (2.5). The 
lower bounds are obtained using only the number of codewords of minimum weight 
of the codes with Eq. (2.8). It can be observed that as - becomes large, the upper 
bound meets and equals the lower bound. The significance of this observation is that 
for = values above the point where the two bounds intersect the performance of 
the codes under soft decision can be completely determined by the lower bound (or 
the upper bound). In this region where the bounds agree, when errors occur they 
do so because the received sequence is closer to codewords a distance d away from 
the correct codeword. The actual performance of the codes before this region is 
somewhere between the upper and lower bounds. As we have seen earlier, the two 
bounds agree when the sum in (2.9) approaches 0. It may be useful to consider an 
approximation of the complementary error function (erfc), 


where 


As such, 


erfc(x) < ex 


in which case the condition becomes 
1 n _в . 
5 У` Ауе NR ao, (2.11) 
j=d+1 


Clearly, the sum approximates to zero if each term in the sum also approximates to 
zero. It is safe to assume that the term A; erfc ( ЕЗ?) decreases as j increases 


since erfc ( Г] | reduces exponentially with j and A; increases in a binomial 
(in most cases). The size of the gap between the lower and upper bounds is also 
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— rR : 
determined by these terms. Each term A; e % RI becomes small if one or both of the 
following conditions are met, 


(a) Some of the А}, j > d are zero. This is common in low rate binary codes with 
a small number of codewords. 

(b) The product MR j for j > d becomes very large. 

Ep 

No 

rate codes for which R — E is small have some A; - 0, j > d and as such the gaps 


Observing Fig. 2.3, 2.4 and 2.5, it can be seen that at small values of and for low 
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between the upper and lower bounds are small. As an example consider the low rate 
(127, 22, 47) BCH code in Fig.2.4a which has, 


Aj —0 je {49...54} U{57...62} U {65...70} U (73... 78] U (81...126]. 


For the high rate codes, Ё is large so that the product AR j becomes very large 
therefore the gaps between the upper and lower bounds are small. 

Figure 2.6 compares bounded distance decoding and full decoding with maximum 
likelihood soft decision decoding of the (63, 39) and (63, 36) BCH codes. It can be 
seen from the figure that whilst the probability of error for maximum likelihood 
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against кь 


hard decision decoding is smaller than that of bounded distance decoding for all the 
values of x ‚ the upper bound on the probability of error for maximum likelihood 


soft décision decoding agrees with the lower bound from certain values of = . This 
suggests that for soft decision decoding, the probability of error can be See 
determined by the lower union bound from a certain value of а . Computing the lower 
union bound from (2.10) requires only the knowledge of the minimum distance of 
the code d and the multiplicity of the minimum weight terms A4. In practice, Ад is 
much easier to obtain than the complete weight distribution of the code. 
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Fig. 2.6 BCH code: Bounded distance, full and maximum likelihood soft decoding 


2.3.1 Performance Assuming a Binomial Weight Distribution 


Evaluating the performance of long codes with many codewords using the union 
upper bound is difficult since one needs to compute the complete weight distribution 
of the codes. For many good linear binary codes, the weight distributions of the codes 
closely approximates to a binomial distribution. Computing the weight distribution 


of a binary code is known to be NP-complete [3]. Let 


(&) be defined as, 
0/8 
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Fig. 2.7 Union bounds using binomial and actual weight distributions (WD) for best known codes 
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Hence, (&) is the SNR per bit at which the difference between upper and lower 
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union bound for the code is very small. It is worth noting that equality is only possible 
x approaches infinity in (2.12) since lim erfc(x) — 0. To find (& 
*—>со 


binary code (л, К, d) we simply assume a binomial weight distribution for the code 
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and compute an xe value that satisfies (2.12). It must be noted that (&), obtained 


using this approach is only an estimate. The accuracy of (&), depends on how 


closely the weight distribution of the code approximates to a binomial and how small 
the difference between the upper and lower union bounds Papper — Ріомег 18. Consider 
Fig. 2.7 that show the upper and lower union bounds using binomial weight distrib- 
utions and the actual weight distributions of the codes. From Fig. 2.7a, it can be seen 
that for the low rate code (127, 30, 37) the performance of the code using the binomial 
approximation of the weight distribution does not t agree with the performance using 
the actual weight distribution at low values of к . Interestingly Fig.2.7b-d show 
that as the rate of the codes increases the КҮНГІ "weight distribution of the codes 
approximates to a binomial. The difference in the performance of the codes using 
the binomial approximation and actual weight distribution decreases as £ increases. 


No 
Figure 2.8 shows the performance of the (255, 120, 40) using a binomial Weight dis- 


tribution. An estimate for &), from the figure is 5.2 dB. Thus for M > 5.2 dB, we 


can estimate the performance of the (255, 120, 40) code under maximum likelihood 
soft decision decoding in the AWGN channel using the lower union bound. 
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2.3.2 Performance of Self-dual Codes 


A self-dual code @ has the property that it is its own dual such that, 
€ —.. 


Self-dual codes are always half rate with parameters (п, іп, d). These codes аге 
known to meet the Gilbert- Varshamov bound and some of the best known codes are 
self-dual codes. Self-dual codes form a subclass of formally self-dual codes which 
have the property that, 


W(@) = WC"). 


where W(@) means the weight distribution of @. The weight distribution of certain 
types of formally self-dual codes can be computed without enumerating all the code- 
words of the code. For this reason, these codes can readily be used for analytical 
purposes. The fact that self-dual codes have the same code rate and good properties 
makes them ideal for performance evaluation of codes of varying length. Consider 
Fig. 2.9 which shows the performance of binary self-dual (and formally self-dual) 
codes of different lengths using the upper and lower union bounds with actual weight 
distributions, bounded distance decoding and unencoded transmission. Figure 2.10 
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Fig. 2.10 Coding gain against code length for self-dual codes at FER 10719 and 10—20 
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shows the coding gain of the self-dual codes at frame error rates (FER) 10719 and 
10729 for soft decision decoding (SDD) and bounded distance decoding (BDD). The 
coding gain represents the difference in dB between the SDD/BDD performance and 
unencoded transmission. The coding gain is a measure of the power saving obtainable 
from a coded system relative to an unencoded system in dB at a certain probability 
of error. The SDD performance of codes with length 168, 136 and 128 at FER 10719 
are obtained from the union upper bound because the upper and lower bound do 
not agree at this FER. Thus, the coding gain for these cases is a lower bound. It is 
instructive to note that the difference between the coding gain for SDD and BDD at 
the two values of FER increases as the length of the code increases. At FER of 10-29 
SDD gives 3.36 dB coding gain over BDD for the code of length 168 and 2.70 dB 
for the code of length 24. At a FER of 10719, SDD gives 3.70 dB coding gain over 
BDD for the code of length 168 and 2.44 dB for the code of length 24. 


2.4 Summary 


In this chapter, we discussed the performance of codes under hard and soft deci- 
sion decoding. For hard decision decoding, the performance of codes in the binary 
symmetric channel was discussed and numerically evaluated results for the bounded 
distance decoder compared to the full decoder were presented for a range of codes 
whose coset leader weight distribution is known. It was shown that as the SNR per 
information bit increases there is still an observable difference between bounded 
distance and full decoders. A lower and upper bound for decoding in the BSC was 
also given for cases where the covering radius of the code is known. For soft decision 
decoding, the performance of a wide range of specific codes was evaluated numer- 
ically using the union bounds. The upper and lower union bounds were shown to 
converge for all codes as the SNR per information bit increases. It was apparent that 
for surprisingly low values of A the performance of a linear code can be predicted 
by only using knowledge of the multiplicity of codewords of minimum weight. It 
was also shown for those codes whose weight distribution is difficult to compute, a 
binomial weight distribution can be used instead. 
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Chapter 3 
Soft Decision and Quantised 
Soft Decision Decoding 


3.1 Introduction 


The use of hard decision decoding results in a decoding loss compared to soft decision 
decoding. There are several references that have quantified the loss which is a function 
of the operating A ratio, the error-correcting code and the quantisation of the soft 
decisions. Wozencraft and Jacobs [6] give a detailed analysis of the effects of soft 
decision quantisation on the probability of decoding error, Р, for the ensemble of 
all binary codes of length n without restriction of the choice of code. Their analysis 
follows from the Coding Theorem, presented by Gallager for the ensemble of random 


binary codes [3]. 


3.2 Soft Decision Bounds 


There are 2" possible binary combinations for each codeword, which in terms of 
the n-dimensional signal space hypercube corresponds to one vertex taken from 
2" possible vertices. There are 2^ codewords and therefore 2" different possible 
codes. The receiver is considered to be composed of 2* matched filters, one for each 
codeword, and a decoder error occurs if any of the matched filter receivers has a larger 
output than the matched filter receiver corresponding to the transmitted codeword. 
Consider this matched filter receiver and another different matched filter receiver, 
and consider that the two codewords differ in d bit positions. The Hamming distance 
between the two codewords is d. The energy per transmitted bitis E, — EE b, Where 
Е is the energy per information bit. The noise variance per matched filtered received 
bit, о? = М. where No is the single sided noise spectral density. In the absence of 
noise, the output of the matched filter receiver for the transmitted codeword is ny Es, 
and the output of the other codeword matched filter receiver is (n — 2d) / E,. The 
noise voltage at the output of the matched filter receiver for the transmitted codeword 


© The Author(s) 2017 43 
M. Tomlinson et al., Error-Correction Coding and Decoding, 

Signals and Communication Technology, 

DOI 10.1007/978-3-319-51103-0 3 


44 3 Soft Decision and Quantised Soft Decision Decoding 


is denoted as п. — nj, and the noise voltage at the output of the other matched filter 

receiver will be ne + n;. The common noise voltage n. arises from correlation of the 

bits common to both codewords with the received noise, and the noise voltages —7, 

and n; arise respectively from correlation of the other d bits with the received noise. 
A decoder error occurs if 


(п – 24) Е; +п. +n, > пу Е; + п. = п, (3.1) 
that is, а decoder error occurs when 2n, > 2d Es. 


The average noise power associated with n; is do? — d m. and as the noise is 
Gaussian distributed, the probability of decoder error, pa, is given by 


1-2 
= e™ dx. 3.2 
м = ae ДЕ (3.2) 


This may be expressed in terms of the complementary error function 


P 


1 99 5 
егіс(у) = 2-- | е? 
Á М2л Jy 


dx (3.3) 


and leads to 


lop] 1259 (3.4) 
— —eric = $ 
Рак 2 n No 


Each of the other 2* — 2 codewords may also cause a decoder error but the weight 
distribution of the code C; is unknown. However, by averaging over all possible 
codes, knowledge of the weight distribution of a particular code is not required. The 
probability of two codewords of a code C;, differing in d bit positions, p(d|C;) is 
given by the Binomial distribution 


n! 


(n—d)!d! 


ШСЛ = 
p(d|C;) 2 


(3.5) 


A given linear code C; cannot have codewords of arbitrary weight, because the sum 
of a sub-set of codewords is also a codeword. However, for non linear codes, pg may 
be averaged over all of the codes without this constraint. 


2" 1 п nak n! КЕ 
doe dicypiC ye — indu! oerfel [а> 3.6 
Рс dria )p(Ci) papa 2 T (3.6) 
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rearranging the order of summation 


әт п п! 
__ 1 та k Ey 
рс < ж 2.2. жен егіс d (3.7) 
and 
Dx n! КЕ, 
pc fef /d-— 3.8 
Рс < màs tx) Өз) 


Remembering that any of the 2* — 1 matched filters may cause a decoder error, the 
overall probability of decoder error averaged over all possible binary codes Роуегай» 
is 


Poverall = 1-(1- Peay < 2 pc (3.9) 
and 
2 < n! КЕ, 
overa. fi d EE TUE 3. 10 
озып = Es tx) SIM 
An analytic solution may be obtained by observing that serfc( y) is upper bounded 
by ет», 
2k Y n! dt (3.11) 
" -- БЕ n No я 
Poverall < 2n a (n = ауа!” 


and as observed by Wozencraft and Jacobs [6], 


n 


NT n! -dt Ph 
(1 +e "^ )" = 2. -------е "№ (3.12) 
x (n — d)!d! 
and 
1 Lk Eb 
pose ry (3-13) 


2 NT 
Poverall < aa +e” No) (3.14) 


46 3 Soft Decision and Quantised Soft Decision Decoding 


Traditionally, a cut-off rate Ro is defined after observing that 


n 


k Ep 
2k NT 1e" 
ZEE наут = 2k oe (3.15) 
with 
2 
2h = (—4) (3.16) 
1-е7% 
then 
Doverall < o = gen = 2-nRo- 7) (3.17) 


This result may be interpreted as, providing the number of information bits of the 
code is less than the length of the code times the cut-off rate, then the probability 
of decoder error will approach zero as the length of the code approaches infinity. 
Alternatively, provided the rate of the code, К, is less than the cut-off rate, Ro, 
then the probability of decoder error will approach zero as the length of the code 
approaches infinity. 

When s quantised soft decisions are used with integer levels 0 to 2s — 1, for s even 
and integer levels 0 to s — 1 for s odd, the transmitted binary signal has levels 0 and 
2(s — 1), for s even and levels 0 and s — 1, for s odd and the probability distribution 
of the quantised signal (bit) plus noise, after matched filtering, has probability p;, 
i = 0 to s — 1, represented as 


5—1 


р(х) = >, piz”, for s even (3.18) 
i=0 
and 
5—1 
р(х) = Уры”, for s odd (3.19) 
і-0 
А decoder error occurs if 
s(n —2d)+ne+tn, > sn+ne— ny (3.20) 


and occurs when 


nı > sd (3.21) 
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and has probability 0.5 when 
n; = sd (3.22) 


The probability of decoder error may be determined from a summation of terms 
from the overall probability distribution for the sum of d independent, quantised 
noise samples, and is given by a polynomial 44(2) at z = 0, where 44(2) is given by 


= z6-0dH 


| = бан) ‚ fors even (3.23) 


1 
qa(z) = p(z)! ( 


The 0.5z°—4 term corresponds to n, = sd when the probability of decoder error is 
0.5. 


1- ағ Е 
ааб) = pz)! (GS - ose), when s is odd (3.24) 


and the 0.5254 term corresponds to n, — sd when the probability of decoder error 
is 0.5. 
The probability of decoder error is given by 44(2) when z — 0, 


Ра = qa(0) (3.25) 


The evaluation ofthe average probability of decoder error for quantised soft decisions, 
Pc, is given, as before by averaging over all codes and rearranging the order of 
summation 


272% oaao 
PG < т 3 53940 (3.26) 
і=1 d=0 
Simplifying 
n n! 
тез y aW (3.27) 
а-0 


When hard decisions аге used, the probability of each transmitted bit being 


received in error is given by 
k Ep 
рь = 0.5егіс --- (3.28) 
n No 
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Accordingly, 
-2 
p(z) = 1 — рь + Poz (3.29) 


and qa(z) for hard decisions becomes 


_ 1:-- тан 
абд-(-рь--рь 294 СЕБ - о) (3.30) 
giving 
! 
o n TESI 1 u Ud 
Рсо < : m (1 — pp + рь)“ (= == osc!) forz=0 (3.31) 


As before, any of the 2^ — 1 matched filters may cause a decoder error, the overall 
probability of decoder error averaged over all possible binary codes Doyeratig, 15 


Poverallo <1— (1 = Peo)” : < 2 pc; (3.32) 


and 


n 


2% n! 


= 2 
, © 
Poverallg 2n 2- (п B ауа! 


1 :4+1 
(1— рь + pez 2)“ СЕБ - o.s") ,forz=0 


(3.33) 


When three-level quantisation is used for the received signal plus noise, a threshold, 
Vthresh 18 defined, whereby, if the magnitude of the received signal plus noise is less 
than v;nresh, an erasure is declared otherwise a hard decision is made. The probability 
of an erasure, регаѕе is given by 


ІЗ 
nEb—Vthresh _,2 


e % dx (3.34) 


: І 
Pease = с 
Vm No Јо 


The probability of a bit error for the hard decision, рь, is now given by 


1 1 Ext 
P= ——— e^ dx (3.35) 
A/7t No E Ey+Vthresh 


Accordingly, p(z) becomes 
po -1- Db — Регаве + фана” + рь? (3.36) 


and 4а (с) for three-level soft decisions is 
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1- тен 
440) = (1 — рь — Peuse + Реже2 + рь 24 ( - о") (3.37) 


= 4 


giving 


OF n! Е 2 
Poverallg < (5 _ (1 Pb Perase ar Регаѕе& ! sb рь e 


1- тан 
(T = о) ) forz=0 (3.38) 


There is a best choice of Уе; which minimises Poyeralig and this is dependent 
on the code parameters, (n, k), and A However, Vihresh is not an unduly sensitive 
parameter and best values typically range from 0.6 to 0.70. The value of 0.650 is 
mentioned in Wozencraft and Jacobs [6]. Optimum values of Vihresh are given in 


Fig. 3.1. 


3.3 Examples 


The overall probability of decoder error averaged over all possible binary codes 
has been evaluated for к = 1 for soft decisions, using Eq. (3.10), ће approxima- 
tion given by Eq. (3.14) and for hard decisions, using Eq. (3.38), for various code 
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lengths. Results are shown in Fig.3.2 for the ensemble of (100, 50) binary codes. 
The difference between the exact random coding bound, Eq. (3.10), and the orig- 
inal, approximate, random coding bound, Eq. (3.14) is about 0.5 dB for (100, 50) 
codes. The loss due to hard decisions is around 2.1 dB (at 1 x 1075 itis 2.18 dB), and 
for three-level quantisation is around 1 dB (at 1 x 1075 it is 1.03 dB). Also shown 
in Fig.3.2 is the sphere packing bound offset by the loss associated with binary 
transmission. 

Results are shown in Fig.3.3 for the ensemble of (200, 100) binary codes. The 
difference between the exact random coding bound, Eq. (3.10), and the original, 
approximate, random coding bound, Eq. (3.14) is about 0.25 dB for (200, 100) codes. 
The loss due to hard decisions is around 2.1 dB, (at 1 x 1075 it is 2.15 dB) and for 
three-level quantisation is around 1 dB, (at 1 x 107° it is 0.999 dB). Also shown 
in Fig.3.3 is the sphere packing bound offset by the loss associated with binary 
transmission. The exact random coding bound is now much closer to the sphere 
packing bound, offset by the loss associated with binary transmission, with a gap of 
about 0.2dB at 1078. It should be noted that the sphere packing bound is a lower 
bound whilst the random binary code bound is an upper bound. 

Instead of considering random codes, the effect of soft decision quantisation is 
analysed for codes with a given weight spectrum. The analysis is restricted to two- 
level and three-level quantisation because these are the most common. In other cases, 
the quantisation is chosen such that near ideal soft decision decoding is realised. The 


FER 
5 


г random (100,50) bound hard 

107 H random (100,50) bound 3 level 
L. random binary (100,50) approx 
random binary (100,50) soft 
binary sphere packing (1 00,50) 


ипжх+ 


0 1 2 8 4 5 6 7 8 
Eb/No [dB] 


Fig. 3.2 Exact and approximate random coding bounds for [100, 50] binary codes and quantised 
decisions 


3.3 Examples 51 


FER 
© 
Т 


F “random (200,100) bound hard 
107 E random (200,100) bound 3-level 


random binary (200,100) approx x 
random binary (200,100) soft H 
в binary sphere packing (200,1 00) z 
10 
-1 0 1 2 3 4 5 6 T 
Eb/No [dB] 


Fig. 3.3 Exact and approximate random coding bounds for [200, 100] binary codes and quantised 
decisions 


analysis starts with a hypothetical code in which the Hamming distance between all 
codewords is the same, dmin. The probability of decoder error due to a single matched 
filter having a greater output than the correct matched filter follows immediately 


from Eq. (3.4) and the code parameters may be eliminated by considering A instead 
of Ёё. 
No 


| f d, E; (3.39) 
= „егіс тіл” . 
Ра 2 No 


For hard decisions and three-level quantisation, pg is given by 


1 2.d T= гЧтїп+1 do 
Pd = (1 — рь — Perase + PeraseZ + DbZ gin E — Q.5z^ni" | forz = 0 


(3.40) 
For hard decisions, Perase is set equal to zero and рь is given by Eq. (3.28). For three- 


level quantisation, Perase is expressed in terms of A , the No ratio required when 
quantised soft decision decoding is used. 


52 3 Soft Decision and Quantised Soft Decision Decoding 


Eg;—Viresh — 2 


e^ dx (3.41) 


: І 
Pease = >= 
мл No Jo 
Similarly, the probability of a bit error for the hard decision, p; is given by 


1 n = 
= e^ dx 3.42 
Ре мул No / EQs+Vihresh | | 


Ву equating Eq. (3.39) with Eq. (3.40), the Eos required for the same decoder error 


No 
probability may be determined as a function of 12: and dmin. The loss, in dB, due to 


soft decision quantisation may be defined as 


Bo. E, 
Losso = 10 x logio —& — 10 x logio > (3.43) 
Q ИШ? fo 


Figure 3.4 shows the soft decision quantisation loss, 1.0550, as a function of dmin and 
К for hard decisions. For low @ мп, the loss is around 1.5 dB but rises rapidly with 


dmin to around 2dB. For x = 3 dB, practical systems operate with d,,;, less than 15 
or so because the decoder error rate is so very low (at dmin = 15, the decoder error 
rate is less than 1 x 10—20). Most practical systems will operate where the loss is 


around 2 dB. Low code rate systems (1 or less) operate with negative ra ratios with 


dmin in the range 25 to 40 whereas i code rate systems with d,,;, in the range 20 to 
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Fig. 3.4 Loss due to hard decisions as a function of SE and din 
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Fig. 3.5 Loss due to three-level soft decisions (erasures) as a function of 5 and dinin 


30 will typically operate at 2: - around OdB. Of course not all decoder error events 
аге dinin events, but the мала nature of the loss produces an average loss of 
around 2 dB. 

Figure 3.5 shows the soft decision quantisation loss, Lossg, as a function of dmin 
and Ea for three-level soft decisions. An optimum threshold has been determined for 


Wes value of dinin and 2 , and these threshold values are in terms of VE, — ухо 
with y хо plotted арап dmin in Fig.3.1. Unlike the hard decision case, for three- 
level quantisation the lowest loss occurs at high dmin Values. In common with hard 
decisions, the lowest loss is for the smallest = N values, which are negative when 


expressed in dB. In absolute terms, the lowest loss is less than 1 dB for га = —3dB 


and high dmin. This corresponds to low-rate codes with code rates of ! ог 1. The loss 
for three-level quantisation is so much better than hard decisions that it is somewhat 
surprising that three-level quantisation is not found more often in practical systems. 
The erasure channel is much underrated. 


3.4 A Hard Decision Dorsch Decoder and BCH Codes 


The effects of soft decision quantisation on the decoding performance of BCH codes 
may be explored using the extended Dorsch decoder (see Chap. 15) and by a bounded 
distance, hard decision decoder, first devised by Peterson [5], refined by Chien [2], 
Berlekamp [1] and Massey [4]. The extended Dorsch decoder may be used directly 


54 3 Soft Decision and Quantised Soft Decision Decoding 


on the received three-level quantised soft decisions and of course, on the received 
unquantised soft decisions. It may also be used on the received hard decisions, to 
form a near maximum likelihood decoder which is a non bounded distance, hard 
decision decoder, but requires some modification. 

The first stage of the extended Dorsch decoder is to rank the received signal 
samples in order of likelihood. For hard decisions, all signal samples have equal 
likelihood and no ranking is possible. However, a random ranking of k, independent 
bits may be substituted for the ranked k most reliable, independent bits. Provided 
the number of bit errors contained in these k bits is within the search space of the 
decoder, the most likely, or the correct codeword, will be found by the decoder. Given 
the received hard decisions contain 7 errors, and assuming the search space of the 
decoder can accommodate rn errors, the probability of finding the correct codeword, 
or a more likely codeword, ру is given by 


m 


n! du fX 
nc» D (|) ( Э) Sed 


i=0 


This probability may be improved by repeatedly carrying out a random ordering of 
the received samples and running the decoder. With N such orderings, the probability 
of finding the correct codeword, or a more likely codeword, руу becomes more likely 
and is given by 


s NN 
m ! t 1 t n—i 
iud ( Ya» () ( ~) ) (3.45) 


Increasing N gives 
m ! t і і n—i N 
n! 
1 1 c0 3.46 
( 2 oou ( ") ) ( ) 


Pup = 1 (3.47) 


апа 


Of course there is a price to be paid because the complexity of the decoder increases 
with N. The parity check matrix needs to be solved N times. On the other hand, 
the size of the search space may be reduced because the repeated decoding allows 
several chances for the correct codeword to be found. 

The modified Dorsch decoder and a bounded distance hard decision BCH decoder 
have been applied to the [63, 36, 11] BCH code and the simulation results are shown 
in Fig.3.6. The decoder search space was set to search 1 x 10° codewords for each 
received vector which ensures that quasi maximum likelihood decoding is obtained. 
Also shown in Fig.3.6 is the sphere packing bound for a (63, 36) code offset by 
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Fig.3.6 Soft decision decoding of the (63, 36, 11) BCH code compared to hard decision decoding 


the binary transmission loss. As can be seen, the unquantised soft decision decoder 
produces a performance close to the offset sphere packing bound. The three-level 
quantisation decoder results are offset approximately 0.9 dB at 1 x 10^? from the 
unquantised soft decision performance. For hard decisions, the modified Dorsch 
decoder has a performance approximately 2dB at 1 x 1073 from the unquantised 
soft decision performance and approximately 2.2 dB at 1 х 1075. Interestingly, this 
hard decision performance is approximately 0.4 dB better than the bounded distance 
BCH decoder correcting up to and including 5 errors. 

The results for the BCH (127, 92, 11) code are shown in Fig. 3.7. These results 
are similar to those of the (63, 36, 11) BCH code. At 1 x 10-5 Frame Error Rate 
(FER), the unquantised soft decision decoder produces a performance nearly 0.2 dB 
from the offset sphere packing bound. The three-level quantisation decoder results 
are offset approximately 1.1 dB at 1 x 1077 from the unquantised soft decision 
pertormancë, This is a higher rate code than the (63, 36, ын code, and at 1 x 1075 
the £ No ratio is 4.1 dB. Figure 3.5 for a dmin of 11 and an ТЕ ratio of 3dB indicates а 
loss of 1. 1dB, giving good agreement to the simulation results. For hard са 
the modified Dorsch decoder has a performance approximately 2 dB at 1 x 107? from 
the unquantised soft decision performance, and approximately 2.1 dB at 1 x 107. 
This is consistent with the theoretical hard decision losses shown in Fig.3.4. As 
before, the hard decision performance obtained with the modified Dorsch decoder 
is better than the bounded distance BCH decoder correcting up to and including five 
errors, and shows almost 0.5 dB improvement. 
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Fig.3.7 Softdecision decoding of the (127, 92, 11) BCH code compared to hard decision decoding 
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Fig.3.8 Softdecision decoding of the (127, 64, 21) BCH code compared to hard decision decoding 
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The results for the BCH (127, 64, 21) code are shown in Fig.3.8. This is an 
outstanding code, and consequently the unquantised soft decision decoding perfor- 
mance is very close to the offset sphere packing bound, being almost 0.1 dB away 
from the bound at 1 х 10?. However, a list size of 107 codewords was used in order 
to ensure that near maximum likelihood performance was obtained by the modified 
Dorsch decoder. Similar to before the three-level quantisation decoder results are 
offset approximately 1.1 dB at 1 x 107° from the unquantised soft decision perfor- 
mance. However, 3 x 10” codewords were necessary in order to obtain near maximum 
likelihood performance was obtained by the modified Dorsch decoder operating on 
the three-level quantised decisions. The BCH bounded distance decoder is approx- 
imately 3dB offset from the unquantised soft decision decoding performance and 
1 dB from the modified Dorsch decoder operating on the quantised hard decisions. 

These simulation results for the losses due to quantisation of the soft decisions 
show a very close agreement to the losses anticipated from the theoretical analysis. 


3.5 Summary 


In this chapter, we derived both approximate and exact bounds on the performance 
of soft decision decoding compared to hard decision decoding as a function of code 
parameters. The effects of soft decision quantisation were explored showing the 
decoding performance loss as a function of number of quantisation levels. Results 
were presented for the ensembles of all (100, 50) and (200, 100) codes. It was shown 
that the loss due to quantisation is a function of both dmin and SNR. Performance 
graphs showing the relationship were presented. 

It was shown that the near maximum likelihood decoder, the Dorsch decoder 
described in Chap. 15, may be adapted for hard decision decoding in order to pro- 
duce better performance than bounded distance decoding. Performance graphs were 
presented for some BCH codes showing the performance achieved compared to 
bounded distance decoding. 
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Part II 
Code Construction 


This part of the book deals with the construction of error-correcting codes having 
good code properties. With an emphasis on binary codes, a wide range of different 
code constructions are described including cyclic codes, double circulant codes, 
quadratic residue codes, Goppa codes, Lagrange codes, BCH codes and Reed- 
Solomon codes. Code combining constructions such as Construction X are also 
included. For shorter codes, typically less than 512 symbols long, the emphasis is on 
the highest minimum Hamming distance for a given length and code rate. The con- 
struction of some outstanding codes is described in detail together with the derivation 
of the weight distributions of the codes. For longer codes, the emphasis is on the best 
code design for a given type of decoder, such as the iterative decoder. Binary convo- 
lutional codes are discussed from the point of view of their historical performance in 
comparison to the performance realised with modern best decoding techniques. Con- 
volutional codes, designed for space communications in the 1960s, are implemented 
as tail-biting block codes. The performance realised with near maximum likelihood 
decoding, featuring the modifed Dorsch decoder described in Chap. 15, is somewhat 
surprising. 


Chapter 4 
Cyclotomic Cosets, the Mattson-Solomon 
Polynomial, Idempotents and Cyclic Codes 


4.1 Introduction 


Much of the pioneering research on cyclic codes was carried out by Prange [5] in the 
1950s and considerably developed by Peterson [4] in terms of generator and parity- 
check polynomials. MacWilliams and Sloane [2] showed that cyclic codes could be 
generated from idempotents and the Mattson-Solomon polynomial, first introduced 
by Mattson and Solomon in 1961 [3]. The binary idempotent polynomials follow 
directly from cyclotomic cosets. 


4.2 Cyclotomic Cosets 


Consider the expansion of polynomial a(x) — I (x — a”). The coefficients of 
а(х) are a cyclotomic coset of powers of о or a sum of cyclotomic cosets of powers 
of a. For example, if m = 4 


a(x) = (x — a)(x — o?)(x — at) (x — a) (4.1) 
and expanding a(x) produces 


a(x) Lx _ (о +a? + a + aS)? $ (а? + + о?! +a? +a Бал 
+ (o +a ғаз a yg са. (4.2) 


Definition 4.1 (Cyclotomic Coset) Let s be a positive integer, and the 2—cyclotomic 
coset of s (mod 7) is given by 
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С, = (2s (mod n)|0<i <4, 


where s is the smallest element in the set С; and 1 is the smallest positive integer 
such that 2/51; = s (mod n). 


For convenience, we will use the term cyclotomic coset to refer to 2—cyclotomic 
coset. If -V is the set consisting of the smallest elements of all possible cyclotomic 
cosets, then it follows that 


С- U C, 2(0,1,2,...,n— 1}. 
SEN 


Example 4.1 The entire cyclotomic cosets of 15 аге as follows: 


Co = {0} 

Cı = {1, 2, 4, 8} 
Сз = {3, 6, 12, 9] 
С; = {5,10} 


C; = {7, 14, 13, 11} 


and VY = (0, 1, 3, 5,7). 


It can be seen that for GF (2^) above, Eq. (4.2), the coefficients of a(x) are a cyclo- 
tomic coset of powers of ога sum of cyclotomic cosets of powers of a. For example, 
the coefficient of x? is the sum of powers of œ from cyclotomic coset СІ. 

In the next step of the argument we note that there is an important property of 
Galois fields. 


Theorem 4.1 For a Galois field G F(p"), then 
(Р(х) + с(х))? = БО)? + cx}. 
Proof Expanding (bæ) + c(x))” produces 
(Бо) + сбх)? =b + ША + г ж сау + (4.3) 
e (, й ШІ + cQ. 
As p modulo p = 0, then all of the binomial coefficients e ) = 0 and 


(рох) + с(х))? = БО)” + cQ). 
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Another theorem follows. 


Theorem 4.2 The sum of powers of œ that are from a cyclotomic coset C; is equal 
to either 1 or 0. 


Proof The sum of powers of о that are from a cyclotomic coset C; must equal to a 
field element, some power, j of œ, о} or 0. Also, from Theorem 1.1, 


(хе) - Уза? 


If the sum of powers of о is non-zero then 


2 
( > ac) = а?) = > «© = ol. 


The only non-zero field element that satisfies а2/ = o/ is œ? = 1. Hence, the sum of 
powers of о that are from a cyclotomic coset C; is equal to either 1 or 0. 


In the example of C; from GF (2^) we have 
(о -- o? +04 +08? = a? +04 оё + 016 = o2 +04 фо +0 
and so 


а 4- à? +a Бо? = 0 or 1. 
Returning to the expansion of polynomial a(x) — I (x — a). Since the coeffi- 
cients of a(x) are a cyclotomic coset of powers of o or a sum of cyclotomic cosets 
of powers of а, the coefficients of а(х) must be 0 or 1 and а(х) must have binary 
coefficients after noting that the coefficient of x? is "7 a” = o?" 7! = 1, the max- 
imum order of o. Considering the previous example of m = 4 (GF (2*)), since a(x) 
is constrained to have binary coefficients, we have the following possible identities: 


ateo’+at+a%=O0orl 
a! Бо! +a’ +a! 20orl 
a? + a -- a +о? +о? + a? = 0 or 1. 
(4.4) 
These identities are determined by the choice of primitive polynomial used to gen- 


erate the extension field. This can be seen from the Trace function, 7;,(x), defined 
as 
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т-1 
Т») = 2-4 (4.5) 
i=0 
and expanding the product of Ту (х) (1 TT, (о) produces the identity 
T, G)(1 + T«()) = x(1 х"). (4.6) 


a is a root of (1 — x") and so а is a root of either 7,,(x) or (1 + Tin (х)), and so either 
T, (o) = 0 or (1 + Tn(@)) = 0. For GF 2^) 


3 


Tn (x) = У = HAG tex х°. (4.7) 
i=0 
Factorising produces 
x x54 x* 4x35 2x0 43x xx xx, (4.8) 
and 
3 " 
1-7,40-1- X Sl HaHa a x. (4.9) 
i=0 
Factorising produces 
xcu oe ux ПСИ ха а), (4.10) 


It may be verified that 


Tm(x)(1 + Tm) = (әх 35) E x b x +24 +29) 
= x(1 - xy 4 x 4x50 x4 xu à) ++ x*) 
(1 x deat x Ag) 


= x(1 — x"). 


Consequently, if 1 + x + x* is used to generate the extension field GF(16) then 
a +a? Бо Бо = 0 and if 1 + x? + x* is used to generate the extension field 
GF(16), then 1 + a + o? + at + o? = 0. 

Taking the case that а(х) = 1 + x + x^ is used to generate the extension field 
GF (16) by comparing the coefficients given by Eq. (4.2), we can solve the identities 
of (4.4) after noting that o? + a! must equal 1 otherwise the order of о is equal to 
5, contradicting o being a primitive root. All of the identities of the sum for each 
cyclotomic coset of powers of o are denoted by S; m and these are 
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$04 -а0-1 

514 = афа? фо фоб = 0 

S4 +0% +0? + =1 

554 = 05 a = 1 

574 = a? +a +a? фа! = 1 

5154 = а? = 1. (4.11) 


The lowest degree polynomial that has В as a root is traditionally known as a minimal 
polynomial [2], and is denoted as М;, where В = а‘. With Mim having binary 
coefficients 


т—1 


Mi, = [[@-a"). (4.12) 


j=0 


For GF (2^) and considering M34 for example, 


M34 = (х — d’) (x — о©)(х a^ yix — an), (4.13) 
and expanding leads to 


M34 = xt — (o? + +012 + a2)? dk (o? +a 4- a+ "S 
+ (a8 +a? +a? + о?)х l. (4.14) 


It will be noticed that this is the same as Eq. (4.2) with o replaced with o?. Using the 
identities of Eq. (4.11), it is found that 


Maga Фа xL (4.15) 


Similarly, it is found that for M54 substitution produces xt +x? + 1 which is (х2 + 
x + 1), and so 


Ms4 =x +x+1; (4.16) 
similarly, it is found that 

Ма-х +x +1 (4.17) 
for Мод with В = 15, and substitution produces x* 4-12 (1+ х) and 


Моа = х+ 1. (4.18) 
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It will be noticed that all of the minimal polynomials correspond to the factors of 
1 + xP given above. Also, it was not necessary to generate a table of GF(2^) field 
elements in order to determine all of the minimal polynomials once M; 4 was chosen. 
A recurrence relation exists for the cyclotomic cosets with increasing т for 


т—1 


Mini = (Пе = DE =o", (4.19) 
j-0 
For m — 4, 
Mi4 = х + 8142 ($34 + 554)х + Sax + a? (4.20) 
and so 


Мі- (“ + 5142? + ($34 + 554)х2 + 574х + ауа + а!9) 


(4.21) 
and 
Mis =? + (016 + Sya)x* + (a 5814 + ($34 + $54) 
+ (o (S34 + 554) + 5а)? + (05854 + «ух + о?! (4.22) 
and we find that 
бы 4 3 
Mis =X + Sy 5x + ($3 5 + $55)x 
+ (S75 + Su 333 + Sis sx +a’. (4.23) 


We have the following identities, linking the cyclotomic cosets of GF (2*) to GF (2°) 


535 + $55 = 019514 + 534 + 554 
575 + 5115 = 016(534 + $54) + 574 


5155 = 0!9874 +a". 


With 1 +x? + 3? used to generate the extension field GF (32), then o + a? + a^ + 
o? + 016 = 0. Evaluating the cyclotomic cosets of powers of о produces 


505 = 00 = 1 

Sis = а +0? +a фо? +016 20 
$35 = a? фаб фа қа” +017 =1 
$55 = à? +a o? фо фа! = 1 


S3 =0 +a +a gea leg 
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2 
8115 = о! +a? фа! +a% + о>! = 1 


8155 = abd +a? +a? +a” +a”? = 0. 


(4.24) 
Substituting for the minimal polynomials, М; 5 produces 
Mos =x+1 
Mi; =x +x +1 
M35 Hartt Ptr +1 
Mss ex ax" 
M35 =? +? +++ 
Mus =x +x +x txl 
Miss = X? Tx) Ld. 
(4.25) 


For GF (2°), the order of a root of a primitive polynomial is 31, a prime number. 
Moreover, 31 is a Mersenne prime (2? — 1) and the first 12 Mersenne primes cor- 
respond to p — 2, 3, 5, 7, 13, 17, 19, 31, 61, 89, 107 and 127. Interestingly, only 49 
Mersenne primes are known. The last known Mersenne prime being 27420728! — 1, 
discovered in January 2016. As (2? — 1) is prime, each of the minimal polynomials 
in Eq. (4.25) is primitive. 

If æ is a root of Т, (x) and m is even, then 1- T», (x) = 1--Т,(х)--(1--7,(хұ))” 


gm 


and œ 77r is a root of x?" . For example, if o is a root of 1 + x + x2, a is of order 3 
and o? is a root of x + x? + x^ + xë. Correspondingly, 1 +x + x? is a factor of 1 4- x? 
and also a factor of1 + x? and necessarily 2?" — 1 cannot be prime. Similarly, if m 
is not a prime and m — ab, then 


= - : pa piu aec p] (4.26) 
and so 
2®%®.—1 = (0#@—59.у gu aos ot 1995s 1, (4.27) 
Similarly 
29.2 p 2220-0 4990-9 4980-3. „туй г]. (4.28) 


Asa consequence 


М (260-1) 4260-2) 4960-3) 4.1) xj т = М; а (4.29) 
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for all minimal polynomials of х=! — 1, and 
M 200-0) 440-2) 240-3) 4.1) xjm = Мрь (4.30) 


for all minimal polynomials of х?—1— 1. 
For M16, following the same procedure, 


Mic = х° + 8\6? + ($36 + S56 + 5960 + (S76 + 8116 + S156 + 91 6)х° 
+ (Sis6 + 536 + $216)X? + 51562 + S31 ex + a. (4.31) 


Substituting for the minimal polynomials, М;6 produces 


Mos — x1 

Mig = х +х +1 

Mag = xf + x* +x 4x41 
Msg =x x +x Bx 
Mig = х° +x +1 

Mog =? +x +1 

Mie =x Fx rx 21 
Mig Sx Rx ВУ 
Miss = х Xx 4244-2741 
Mas =x +x+1 

Mg = x ++? +f +x +1 
Мэв =x +x+1 

Мув = x8 +0 +1. (4.32) 


Notice that Mog = M34 because o? + 0! + 026 = 1 and Му = Муд because 
a? + o!8 +g = 0. М6 = М, з because o?! + 02 = 1. The order of o is 63 which 
factorises to 7 x 3 x З and so x — 1 will have roots of order 7 (o?) and roots of 
order 3 (021). Another way of looking at this is the factorisation of х6 — 1. 37 — 1 
is a factor and x? — 1 is a factor 


x9 E 1 = (x? A Dü cx + xlt 4 x 
x28 + x95 x42 + x49 + 26) (4.33) 


also 


х6 — 1 2 (х = (1+ 4x6 + x xD up x! 4 x18 4 2! 
+ x24 4 x?! 4 x30 + x9 4 36 + x? 4 x42 + x? (4.34) 
4+ x48 Le + х2 Lx + x80) 
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and 
xy =з ра? 4240 
х'—1 = 6406 e206 ЕЕ) 
х® — 1 = +D +++ DG 424 DG HHDH) 
GP ee a Hx). aÉ dex 0. (4.35) 
For М; 


Мі-х + S1746 + (837 + S57 + So7)x* + (877 + S117 + 813748197 + $211) 


+ (5157 + $237 + 5277 + от)? + (S157 + 8317 + $43 14-8411 + $557)х” 
+ S53 7x + @!?7. 


(4.36) 


Although the above procedure using the sums of powers of o from the cyclotomic 
cosets may be used to generate the minimal polynomials M; m for any m, the procedure 
becomes tedious with increasing т, and it is easier to use the Mattson Polynomial 
or combinations of the idempotents as described in Sect. 4.4. 


4.3 The Mattson-Solomon Polynomial 


The Mattson-Solomon polynomial is very useful for it can be conveniently used to 
generate minimal polynomials and idempotents. It also may be used to design cyclic 
codes, RS codes and Goppa codes as well as determining the weight distribution 
of codes. The Mattson-Solomon polynomial [2] of a polynomial a(x) is a linear 
transformation of a(x) to A(z). The Mattson-Solomon polynomial is the same as the 
inverse Discrete Fourier Transform over a finite field. The polynomial variables x 
and z are used to distinguish the polynomials in either domain. 

Let the splitting field of x" — 1 over IF? be Fy», where n is an odd integer and 
m > 1, and let a generator of Еҙ» be о and an integer r = (2" — 1)/n. Let a(x) bea 
polynomial of degree at most n — 1 with coefficients over Fam. 


Definition 4.2 (Mattson-Solomon polynomial) The Mattson-Solomon polynomial 
of a(x) is the linear transformation of a(x) to A(z) and is defined by [2] 


п—1 
A(z) = MS(a()) = У ао). (4.37) 


j=0 


The inverse Mattson—Solomon transformation or Fourier transform is 
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Table 4.1 СЕ(16) extension field defined by 1 + œ + o^ —0 


о 
= 


=a 


оомо t RB UU I 


R R R 9 9 9 S9 8 9S ов S оо © 


п—1 


a(x) = М8" ҚА(2)- ! SECUS (4.38) 
i=0 


The integer ғ comes into play when 2” — 1 is not a prime, that is, 2" — 1 is not 
a Mersenne prime, otherwise r = 1. As an example, we will consider Fs and the 
extension field table of non-zero elements is given in Table4.1 with 1 Һа 4- o^ = 0, 
modulo 1 + x. 

Consider the polynomial a(x) denoted as 


п—1 
а(х) = Хаж qux pa (4.39) 
i=0 


We will evaluate the Mattson—Solomon polynomial coefficient by coefficient: 


A(0) = ад + аз +ад= 1+1+1 = 1 


A(1) = ао аза? ада = 1 a? pal! =1+1+a +e? Бо а Бо? +o = 0 
А(2) = ао аза ® ада 5 21 о фо! = 1 +а+о? +1 +а+а? = 0 
А(3) = ао аза”? аа 2-1 роб фо = 1 +02 оз +о? = о? 


| 
Т 
A(4) — ag аза? ада 16-1 о al^ = 1 Фо 1499 —0 


A(5) = ag аза 15 ада 79 =1+1+a%=q! 


A(6) = ао аза 18 ада 


А(7) — ag азе?! ада 


A(8) = ао аза ^ ада? = 1 фоб +a} = 0 
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A(9) = ag аза 27 ада 36 = 1 фо фо = 1 фо = о 


А(10) = ао аза 30 ада 0 =1+1+о = оў 


A(11) = ao аза 33 ада 
А(12) = ао аза 36 ада 48 =l+a?+a’%=a? 
А(13) = ао аза 39 ада? = 1 фоб фоб = о? 


А(14) = ao +аза + aga = 1 a? +04 = о. (4.40) 


К can be seen that A(z) is 


A(Z) =1+ a*z? + 01925 а + 01237 + atz? + 3210) + оё! + 02212 
giz? at 


A(z) has four zeros corresponding to the roots o^! , 272, a~* and o^ 5, and these 


are the roots of 1 + x? + x^. These are also 4 of the 15 roots of 1 + x!>. Factorising 
1 + x? produces the identity 


1+х = 0 х)(1+х + x31 x-x*)0- x 4x) xx) rx + л). 
(4.41) 


It can be seen that 1 + x? + x^ is one of the factors of 1 +x). 

Another point to notice is that A(z) — A(z)? and A(z) is an idempotent. The reason 
for this is that the inverse Mattson-Solomon polynomial of A(z) will produce a(x) a 
polynomial that has binary coefficients. Let - denote the dot product of polynomials, 
i.e. 


(С) (> вг!) = Y AB. 


It follows from the Mattson-Solomon polynomial that with a(x)b(x) — c(x), 
Уг С! = > AiBiz. 

This concept is analogous to multiplication and convolution in the time and fre- 
quency domains, where the Fourier and inverse Fourier transforms correspond to the 
inverse Mattson-Solomon and Mattson-Solomon polynomials, respectively. In the 
above example, A(z) is an idempotent which leads to the following lemma. 


Lemma 4.1 The Mattson—Solomon polynomial of a polynomial having binary coef- 
ficients is an idempotent. 


Proof Let c(x) — a(x) - b(x). The Mattson-Solomon polynomial of c(x) is C(z) — 
A(z)B(z). Setting b(x) = а(х) then C(z) = A(z)A(z) = A(z). If a(x) has binary 
coefficients, then c(x) = a(x) - a(x) = а(х) and A(z)* = A(z). Therefore A(z) is an 
idempotent. 
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Of course the reverse is true. 


Lemma 4.2 The Mattson—Solomon polynomial of an idempotent is a polynomial 
having binary coefficients. 


Proof Let c(x) — a(x)b(x). The Mattson-Solomon polynomial of c(x) is C(z) — 
A(z)B(z). Setting р(х) = a(x) then C(z) = A(z) - A(z). If a(x) is an idempotent then 
c(x) = а(х)? = a(x) and A(z) = A(z) - A(z). The only values for the coefficients of 
A(z) that satisfy this constraint are the values 0 and 1. Hence, the Mattson Solomon 
polynomial, A(z), has binary coefficients. 


A polynomial that has binary coefficients and is an idempotent is a binary idem- 
potent, and combining Lemmas 4.1 and 4.2 produces the following lemma. 


Lemma 4.3 The Mattson—Solomon polynomial of a binary idempotent is also a 
binary idempotent. 


Proof The proof follows immediately from the proofs of Lemmas4.1 and 4.2. As 
а(х) is an idempotent, then from Lemma4.1, A(z) has binary coefficients. As а(х) 
also has binary coefficients, then from Lemma 4.2, A(z) is an idempotent. Hence, 
A(z) is a binary idempotent. 


As an example consider the binary idempotent a(x) from GF(16) listed in 
Table 4.1: 
a(x) Е Ва Rx фаба pe x, 


The Mattson-Solomon polynomial A(z) is 
A(z) =z +z"! +z? +z", 
which is also a binary idempotent. 


Since the Mattson polynomial of а(х!) is the same as the inverse Mattson poly- 
nomial of a(x) consider the following example: 


14 


а(х) =x 7px +x аа m edat tup vt 
The Mattson-Solomon polynomial A(z) is the binary idempotent 


A(2 =z +20 + +25 5 0 Haz. 


This is the reverse of the first example above. 
The polynomial 1 + x + x? has no roots of 1 + х! and so defining Р(х) 


Ь(х) = (o x43 ЕК ЕУ Leet ақ (4.42) 
When the Mattson-Solomon polynomial is evaluated, B(z) is given by 


B&Q =1+@+@-+@ +. (4.43) 
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4.4 Binary Cyclic Codes Derived from Idempotents 


In their book, MacWilliams and Sloane [2] describe the Mattson-Solomon polyno- 
mial and show that cyclic codes may be constructed straightforwardly from idem- 
potents. An idempotent is a polynomial 0(x) with coefficients from a base field 
GF (p) that has the property that ӨР(х) = Ө(х). The family of Bose-Chaudhuri- 
Hocquenghem (BCH) cyclic codes may be constructed directly from the Mattson- 
Solomon polynomial. From the idempotents, other cyclic codes may be constructed 
which have low-weight dual-code codewords or equivalently sparseness of the parity- 
check matrix (see Chap. 12). 


Definition 4.3 (Binary Idempotent) Consider e(x) € T (x), e(x) is an idempotent if 
the property of e(x) — e (x) = е(х2) mod (x" — 1) is satisfied. 


An (n, k) binary cyclic code may be described by the generator polynomial g (x) € 
T (x) of degree n — К and the parity-check polynomial h(x) € T (x) of degree К, such 
that g (x)h(x) = x" — 1. According to [2], as an alternative to g(x), an idempotent may 
also be used to generate cyclic codes. Any binary cyclic code can be described by a 
unique idempotent e,(x) € T(x) which consists of a sum of primitive idempotents. 
The unique idempotent e, (х) is known as the generating idempotent and as the name 
implies, g(x) is a divisor of e, (x), and to be more specific e, (x) = m(x)g(x), where 
m(x) € T (x) contains repeated factors or non-factors of x" — 1. 


Lemma 4.4 /f e(x) € T (x) is an idempotent, E(z) = MS(e(x)) є T(z). 


Proof Since e(x) — e(x)? (mod x" — 1), from (4.37) it follows that e(a~”) = 
е(а77)2 for = (0,1,...,n — 1} and some integer ғ. Clearly e(a~%) є 10,1) 
implying that Е(2) is a binary polynomial. 


Definition 4.4 (Cyclotomic Coset) Let s be a positive integer, and the 2—cyclotomic 
coset of s (mod 7) is given by 


С, = (2s (modm)|0xizt), 


where we shall always assume that the subscript s is the smallest element in the set 
C, and t is the smallest positive integer such that 2^*!s = s (mod n). 


For convenience, we will use the term cyclotomic coset to refer to 2—cyclotomic 
coset throughout this book. If VW is the set consisting of the smallest elements of all 
possible cyclotomic cosets, then it follows that 


C= |] &={0,1,2,...,n— 1}. 
SEN 


Definition 4.5 (Binary Cyclotomic Idempotent) Let the polynomial e,(x) € T(x) be 
given by 
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ews >, w, (4.44) 


0<г<|С,|—1 


where |C;| is the number of elements іп С, and С; = 2's (mod n), the (i + 1)th 
element of C,. The polynomial е, (x) is called a binary cyclotomic idempotent. 


Example 4.2 Тһе entire cyclotomic cosets of 63 and their corresponding binary 
cyclotomic idempotents are as follows: 


Co — 10) eo(x) = 1 
C; = {1, 2, 4, 8, 16, 32} ex) =x 4x 434428 4416 4 x? 
C3 = {3, 6, 12, 24, 48, 33} ез(х) = gy qox aa quam 


C5 = {5, 10, 20, 40, 17, 34} e5(x) = x? +x! 4 xU up x ux х0 
C; — (7, 14, 28, 56, 49, 35) ey(x) = x! + x + x28 + х” + x? + x 
С» = {9, 18, 36} eg) = х9 + x18 4 х6 

Сп —(11,22,44,25,50,37) eu (x) = xl! +x” +a” p x + х 4 х0 
Сіз = {13, 26, 52, 41, 19,38} eis (x) = xP + х! + х26 + 78 4 yt 4 х” 
Сіз = {15, 30, 60, 57, 51,39} еѕ(х) = xP +x 4 х3 4 х5! + 7 4 х0 


Co, = {21,42} en) = x + x? 
Соз = {23, 46, 29, 58, 53, 43} ezn (x) = xP +x? x Hx xy? 
Cz = (27, 54, 45} ел(х) = x? p x9 + x4 


C31 = {31, 62, 61, 59, 55,47} езү(х) = x! xU x? px хбр 


and VY = (0, 1,3, 5, 7, 9, 11, 13, 15, 21, 23, 27, 31}. 


Definition 4.6 (Binary Parity-Check Idempotent) Let С N and let the polyno- 
тігі u(x) € T (x) be defined by 


u(x) = У es(x), (4.45) 


SEM 


where е;(х) is an idempotent. The polynomial u(x) is called a binary parity-check 
idempotent. 


The binary parity-check idempotent u(x) can be used to describe an [n, k] cyclic 
code. Since GCD(u(x), x" — 1) = h(x), the polynomial a(x) = x4) u(x!) and its 
ncyclic shifts (mod x”— 1) can be used to define the parity-check matrix of a binary 
cyclic code. In general, мін (и(х)) is much lower than wtg (A(x)), and therefore а 
sparse parity-check matrix can be derived from u(x). This is important for cyclic 
codes designed to be used as low-density parity-check (LDPC) codes, see Chap. 12. 
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4.4.1  Non-Primitive Cyclic Codes Derived from Idempotents 


The factors of 2" — ] dictate the degrees of the minimal polynomials through the 
order of the cyclotomic cosets. Some relatively short non-primitive cyclic codes have 
minimal polynomials of high degree which makes it tedious to derive the generator 
polynomial or parity-check polynomial using the Mattson-Solomon polynomial. The 
prime factors of 2" — 1 for m < 43 are tabulated below in Table 4.2. 

The Mersenne primes shown in Table4.2 are 2? — 1, 25 — 1, 27 — 1, 28 — 1, 
2! — 1, 2? — 1, 223 — 1 and 2?! — 1, and cyclic codes of these lengths are primitive 
cyclic codes. Non-primitive cyclic codes have lengths corresponding to factors of 
2" — 1 which are not Mersenne primes. Also it may be seen in Table4.2 that for т 
even, 3 is a common factor. Where т is congruent to 5, with m = 5 х s,3lisa 
common factor and all M; 5 minimal polynomials will be contained in the set, M; 5, ; 
of minimal polynomials. 

As an example of how useful Table4.2 can be, consider a code of length 113. 
Table 4.2 shows that 228 — 1 contains 113 as a factor. This means that there is a 
polynomial of degree 28 that has a root В of order 113. In fact, В = 0237535, where 
о is a primitive root, because 228 — 1 = 2375535 x 113. 

The cyclotomic cosets of 113 are as follows: 


Co — (0j 
СІ — (1, 2, 4, 8, 16, 32, 64, 15, 30, 60, 7, 14, 28, 56, 

112, 111, 109, 105, 97, 81, 49, 98, 83, 53, 106, 99, 85, 57] 
C3 — (3, 6, 12, 24, 48, 96, 79, 45, 90, 67, 21, 42, 84, 

55, 110, 107, 101, 89, 65, 17, 34, 68, 23, 46, 92, 71, 29, 58] 
Cs = (5, 10, 20, 40, 80, 47, 94, 75, 37, 74, 35, 70, 27, 

54, 108, 103, 93, 73, 33, 66, 19, 38, 76, 39, 78, 43, 86, 59] 
C; — (9, 18, 36, 72, 31, 62, 11, 22, 44, 88, 63, 13, 26, 

52, 104, 95, 77, 41, 82, 51, 102, 91, 69, 25, 50, 100, 87, 61]. 


Each coset apart from Со may be used to define 28 roots from a polynomial 
having binary coefficients and of degree 28. Alternatively, each cyclotomic coset 
may be used to define the non-zero coefficients of a polynomial, a minimum weight 
idempotent (see Sect. 4.4). Adding together any combination of the 5 minimum 
weight idempotents generates a cyclic code of length 113. Consequently, there are 
only 2? — 2 = 30 non-trivial, different cyclic codes of length 113 and some of these 
will be equivalent codes. Using Euclid's algorithm, it is easy to find the common 
factors of each idempotent combination and x!!? — 1. The resulting polynomial may 
be used as the generator polynomial, or the parity-check polynomial of the cyclic 
code. 
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For example, consider ће GCD of C, + Сз = x + LHE ФФ фә +... + 
x109 4 H0 + H1 ХЫ? and x15 — 1. This is the polynomial, u(x), which turns out 
to have degree 57 


ux) = 1-2- x t x? xà x xS px! up x19 e x? 


tt up x32 4 х°* + х? + 96 4 х?? 


Using и(х) as the parity-check polynomial of the cyclic code produces a (113, 57, 
18) code. This is quite a good code as the very best (113, 57) code has a minimum 
Hamming distance of 19. 

As another example of using this method for non-primitive cyclic code construc- 
tion, consider the factors of 23? — 1 in Table 4.2. It will be seen that 79 is a factor 
and so a cyclic code of length 79 may be constructed from polynomials of degree 
39. The cyclotomic cosets of 79 are as follows: 


Co = {0} 
C; = {1, 2, 4, 8, 16, 32, 64, 49, 19, 38, 76, 73, ... 20, 40} 
Сз = (3,6, 12, 24, 48, 17, 34, 68, 57, 35, 70, ... 60, 41}. 


Тһе ССР of the idempotent sum given by the cyclotomic cosets Co + С and x? — 1 
is the polynomial, u(x), of degree 40: 


u(x) = 1 ра а ааа” 


ES x28 Je x? 4 x зр 36 ES x? T x40 


Using u(x) as the parity-check polynomial of the cyclic code produces a (79, 40, 
15) code. This is the quadratic residue cyclic code for the prime number 79 and is a 
best-known code. 

Ina further example Table 4.2 shows that 2°” — 1 has 223 as a factor. The GCD of the 
idempotent given by the cyclotomic coset Сз x? --x$4-x 2 +x x48 4. , , , 3198 4.204 
and x??? — 1 is the polynomial, u(x), of degree 111 


u(x) = 1+2 a ba pa А? x y? 


+x” +x? +x” + x10 +x 4 xi! 


Using u(x) as the parity-check polynomial of the cyclic code produces a (223, 111, 
32) cyclic code. 


78 4 Cyclotomic Cosets, the Mattson-Solomon Polynomial ... 


4.5 Binary Cyclic Codes of Odd Lengths from 129 to 189 


Since many of the best-known codes are cyclic codes, it is useful to have a table of 
the best cyclic codes. The literature already contains tables of the best cyclic codes 
up to length 127 and so the following table starts at 129. АП possible binary cyclic 
codes up to length 189 have been constructed and their minimum Hamming distance 
has been evaluated. 

The highest minimum distance attainable by all binary cyclic codes of odd lengths 
129 < n x 189 is tabulated in Table4.3. The column “Roots of g(x)” in Table4.3 
denotes the exponents of roots of the generator polynomial g(x), excluding the con- 
jugate roots. All cyclic codes with generator polynomials 1 +x and (x" — 1) /(1+ x), 
since they are trivial codes, are excluded in Table 4.3 and since primes n = 8m + 3 
contain these trivial cyclic codes only, there is no entry in the table for these primes. 
The number of permutation inequivalent and non-degenerate cyclic codes, excluding 
the two trivial codes mentioned earlier, for each odd integer п is given by №. The 
primitive polynomial m(x) defining the field is given in octal. Full details describing 
the derivation of Table 4.3 are provided in Sect. 5.3. 

In Table4.3, there is no cyclic code that improves the lower bound given by 
Brouwer [1], but there are 134 cyclic codes that meet this lower bound and these 
codes are printed in bold. 


4.6 Summary 


The important large family of binary cyclic codes has been explored in this chapter. 
Starting with cyclotomic cosets, the minimal polynomials were introduced. The 
Mattson-Solomon polynomial was described and it was shown to be an inverse 
discrete Fourier transform based on a primitive root of unity. The usefulness of the 
Mattson-Solomon polynomial in the design of cyclic codes was demonstrated. The 
relationship between idempotents and the Mattson-Solomon polynomial of a poly- 
nomial that has binary coefficients was described with examples given. It was shown 
how binary cyclic codes may be easily derived from idempotents and the cyclotomic 
cosets. In particular, a method was described based on cyclotomic cosets for the 
design of high-degree non-primitive binary cyclic codes. Code examples using the 
method were presented. 

A table listing the complete set of the best binary cyclic codes, having the highest 
minimum Hamming distance, has been included for all code lengths from 129 to 189 
bits. 
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Chapter 5 
Good Binary Linear Codes 


5.1 Introduction 


Two of the important performance indicators for a linear code are the minimum 
Hamming distance and the weight distribution. Efficient algorithms for computing 
the minimum distance and weight distribution of linear codes are explored below. 
Using these methods, the minimum distances of all binary cyclic codes of length 129— 
189 have been enumerated. The results are presented in Chap. 4. Many improvements 
to the database of best-known codes are described below. In addition, methods of 
combining known codes to produce good codes are explored in detail. These methods 
are applied to cyclic codes, and many new binary codes have been found and are 
given below. 

The quest of achieving Shannon's limit for the AWGN channel has been 
approached in a number of different ways. Here we consider the problem formu- 
lated by Shannon of the construction of good codes which maximise the difference 
between the error rate performance for uncoded transmission and coded transmis- 
sion. For uncoded, bipolar transmission with matched filtered reception, it is well 
known (see for example Proakis [20]) that the bit error rate, рь, is given by 


"n NE (5.1) 
Рь = 8 No m A 


Comparing this equation with the equation for the probability of error when using 
coding, viz. the probability of deciding on one codeword rather than another, Eq. (1.4) 
given in Chap. 1, it can be seen that the improvement due to coding, the coding 
gain is indicated by the term йм. E the product of the minimum distance between 
codewords and the code rate. This is not the end of the story in calculating the overall 
probability of decoder error because this error probability needs to be multiplied by 
the number of codewords distance dmin apart. 

For a linear binary code, the Hamming distance between two codewords is equal 
to the Hamming weight of the codeword formed by adding the two codewords 
together. Moreover, as the probability of decoder error at high ті values depends 
on the minimum Hamming distance between codewords, for a linear binary code, 
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the performance of the code depends on the minimum Hamming weight codewords 
of the code, the dmin of the code and the number of codewords with this weight 
(the multiplicity). For a given code rate (5) and length п, the higher the weight of 
the minimum Hamming weight codewords of the code, the better the performance, 
assuming the multiplicity is not too high. It is for this reason that a great deal of 
research effort has been extended, around the world in determining codes with the 
highest minimum Hamming weight for a given code rate ( E) and length n. These 
codes are called the best-known codes with parameters (7, k, d), where d is under- 
stood to be the dmin of the code, and the codes are tabulated in a database available 
online [12] with sometimes a brief description or reference to their method of con- 
struction.! 

In this approach, it is assumed that a decoding algorithm either exists or will be 
invented which realises the full performance of a best-known code. For binary codes 
of length less than 200 bits the Dorsch decoder described in Chap. 15 does realise 
the full performance of the code. 

Computing the minimum Hamming weight codewords of a linear code is, in 
general, a Nondeterministic Polynomial-time (NP) hard problem, as conjectured by 
[2] and later proved by [24]. Nowadays, it is a common practice to use a multi- 
threaded algorithm which runs on multiple parallel computers (grid computing) for 
minimum Hamming distance evaluation. Even then, it is not always possible to 
evaluate the exact minimum Hamming distance for large codes. For some algebraic 
codes, however, there are some shortcuts that make it possible to obtain the lower 
and upper bounds on this distance. But knowing these bounds are not sufficient 
as the whole idea is to know explicitly the exact minimum Hamming distance of a 
specific constructed code. As a consequence, algorithms for evaluating the minimum 
Hamming distance of a code are very important in this subject area and these are 
described in the following section. 

It is worth mentioning that a more accurate benchmark of how good a code is, 
in fact its Hamming weight distribution. Whilst computing the minimum Hamming 
distance of a code is in general NP-hard, computing the Hamming weight distribution 
of a code is even more complex. In general, for two codes of the same length and 
dimension but of different minimum Hamming distance, we can be reasonably certain 
that the code with the higher distance is the superior code. Unless we are required to 
decide between two codes with the same parameters, including minimum Hamming 
distance, it is not necessary to go down the route of evaluating the Hamming weight 
distribution of both codes. 


! Multiplicities are ignored in the compiling of the best, known code Tables with the result that 
sometimes the best, known code from the Tables is not the code that has the best performance. 
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5.2 Algorithms to Compute the Minimum Hamming 
Distance of Binary Linear Codes 


5.2.1 The First Approach to Minimum Distance Evaluation 


For a [n, k, d] linear code over Еҙ with a reduced-echelon generator matrix G,,, = 
ПІРІ, where Т, and P are k х k identity and k x (n — К) matrices respectively, 
a codeword of this linear code can be generated by taking a linear combination of 
some rows of G,,,. Since the minimum Hamming distance of a linear code is the 
minimum non-zero weight among all of the 2* codewords, a brute-force method to 
compute the minimum distance is to generate codewords by taking 


() 0) GG) Q 


linear combinations of the rows іп G;,;, noting the weight of each codeword gener- 
ated and returning the minimum weight codeword of all 2^ — 1 non-zero codewords. 
This method gives not only the minimum distance, but also the weight distribution of 
a code. Itis obvious that as k grows larger this method becomes infeasible. However, 
if n — К is not too large, the minimum distance can still be obtained by evaluating 
the weight distribution of the [n,n — k, d'] dual code and using the MacWilliams 
Identities to compute the weight distribution of the code. It should be noted that the 
whole weight distribution of the [n, n — k, d'] dual code has to be obtained, not just 
the minimum distance of the dual code. 

In direct codeword evaluation, it is clear that there are too many unnecessary 
codeword enumerations involved. A better approach which avoids enumerating large 
numbers of unnecessary codewords can be devised. Let 


€ — (i| p) = (co, €i, ..., Ch-11Cks -.-, Cn—25 Cn—1) 


be a codeword of a binary linear code of minimum distance d. Let c' = (i'|p’) bea 
codeword of weight d, then if wtg (i^) = wforsomeintegerw < d, wty(p’) = d—w. 


This means that at most 
min{d—1,k} k 
> (5.2) 
w 


w=1 


codewords are required to be enumerated. 

In practice, d is unknown and an upper bound d,; on the minimum distance is 
required during the evaluation and the minimum Hamming weight found thus far can 
be used for this purpose. It is clear that once all У”, ( E) codewords of information 
weight w’ are enumerated, 


e we know that we have considered all possibilities of d < w; and 
e if w < а,,, we also know that the minimum distance of the code is at least w + 1. 
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Therefore, having an upper bound, a lower bound dj, = w + 1 on the minimum 
distance can also be obtained. The evaluation continues until the condition dj, > dub 
is met and in this event, 4, is the minimum Hamming distance. 


5.2.2 Brouwer's Algorithm for Linear Codes 


There is an apparent drawback of the above approach. In general, the minimum 
distance of a low-rate linear code is greater than its dimension. This implies that 
d (5 codewords would need to be enumerated. A more efficient algorithm was 


attributed to Brouwer? and the idea behind this approach is to use a collection of 
generator matrices of mutually disjoint information sets [11]. 


Definition 5.1 (Information Set) Let the set S = (0, 1,2, ..., n—] be the coordi- 
nates of an [n, k, d] binary linear code with generator matrix С. The set .Z С S of 
k elements is an information set if the corresponding coordinates in the generator 
matrix is linearly independent and the submatrix corresponding to the coordinates in 
J has rank К, hence, it can be transformed into a k х k identity matrix. 


In other words, we can say, in relation to a codeword, the k symbols user message 
is contained at the coordinates specified by ./ and the redundant symbols are stored 
in the remaining п — К positions. 

An information set corresponds to a reduced-echelon generator matrix and it 
may be obtained as follows. Starting with a reduced-echelon generator matrix 


GO = бу = ПАР], Gaussian elimination is applied to submatrix P so that 
it is transformed to reduced-echelon form. 
The resulting generator matrix now becomes G®, = [A|I,|P'], where P’ is 


SYS 
a k x (n — 2k) matrix. Next, submatrix Р” is put into reduced-echelon form and 


the process continues until there exists a k x (n — Ik) submatrix of rank less than 
k, for some integer /. Note that column permutations may be necessary during the 
transformation to maximise the number of disjoint information sets. 

Let 4 be a collection of m reduced-echelon generator matrices of disjoint infor- 
mation sets, Y = (6% GO,..., ве 


Sys? sys? ** sys J^ 
Using these m matrices means that after У, (5) enumerations 
e all possibilities of d < mw have been considered; and 
e if mw < а,,, the minimum distance of the code is at least m(w + 1), i.e. dip = 


m(w + 1). 


We can see that the lower bound has been increased by a factor of m, instead of 1 
compared to the previous approach. For w < k/2, we know that (^) >> (,*,) and 
this lower bound increment reduces the bulk of computations significantly. 

If d is the minimum distance of the code, the total number of enumerations required 
is given by 


?7immermann attributed this algorithm to Brouwer in [25]. 
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min{[d/m]—1,k} 
w=1 


linear, a shortened code of the Goppa code discovered by [15]. The reduced-echelon 


Example 5.1 (Disjoint Information Sets) Consider the [55, 15, 20] optimal binary 
generator matrices of disjoint information sets are given by 
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distance of this code is 20. In contrast, for the same proof, 32767 codewords would 


Brouwer's algorithm requires 9948 codewords to be evaluated to prove the minimum 
need to be evaluated if only one generator matrix is employed. 
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5.2.3 Zimmermann's Algorithm for Linear Codes and Some 
Improvements 


A further refinement to the minimum distance algorithm is due to Zimmermann 
[25]. Similar to Brouwer's approach, a set of reduced-echelon generator matrices 
are required. While in Brouwer's approach the procedure is stopped once a non- 
full-rank submatrix is reached; Zimmermann's approach proceeds further to obtain 
submatrices with overlapping information sets. Let GY) [Anm] Z| B, 1] be the last 
generator matrix which contains a disjoint information set. To obtain matrices with 
overlapping information sets, Gaussian elimination is performed on the submatrix 


В „+ and this yields 
^ 0 [1 
А, Гт+1 
| Ita 0 


where ғ, = Rank (B,,,,). Next, Gat 2 is produced by carrying out Gaussian 
elimination on the submatrix B,, and so on. 


From GO of Example 5.1, we can see that the last 10 coordinates do not form an 


Gary = 


sys 


Bs] , 


5 
information set since ће rank of this submatrix is clearly less than k. Nonetheless, а 


"partial" reduced-echelon generator matrix can be obtained from 6. 
0111111001011010010100110001100101010000 | 00000 | 1000000000 
1100110000010110000010111110000110101110 | 00000 | 0100000000 
1010010000110001011100111001110100001110 | 00000 | 0010000000 
0010010010001100001001001001111011101111 | 00000 | 0001000000 
1011110010101000101110010011100001100010 | 00000 | 0000100000 
1010001011011101111000001000101101010100 | 00000 | 0000010000 

(4) 010000010001101110111101111111001000111i | 00000 | 0000001000 
G) = | i011101011001011101101001111111100111011 | 00000 | 0000000100 
sys 01110101111111000100111111010001 11110111 | 00000 | 0000000010 
0101101011111001000001100100100110101010 | 00000 | 0000000001 
1100001101000000101011001011001001111101 | 10000 | 0000000000 
1001001100000111011010111010001110010001 | 01000 | 0000000000 
0111000001101001110100010110011000101110 | 00100 | 0000000000 
0001001111000011011101000010101011001110 | 00010 | 0000000000 
1111111100111111110000011110110100010111 | 00001 | 0000000000 

From GO, we can see that the last k columns is also an information set, but k — 

Rank (GC) coordinates of which overlap with those in GO. The generator matrix 


GO then may be used to enumerate codewords with condition that the effect of 
overlapping information set has to be taken into account. 

Assuming that all codewords with information weight « w have been enumerated, 
we know that 


e for all Gi. of full-rank, say there are m of these matrices, all cases of d < mw 
have been considered and each contributes to the lower bound. 

As a result, the lower bound becomes dj, = m(w + 1). 

e for each GO. that do not have full-rank, we can join G sys 
of GO, for j < i, so that we have an information set .%, which of course 
overlaps with information set Jf. Therefore, for all of these matrices, say M, 
all cases of d < Mw have been considered, but some of which are attributed 


to other information sets, and considering these would result in double counting. 


© with column subsets 
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According to Zimmermann [25], for each matrix Go Ð with an overlapping 
information set unless w > k — Rank (By 1) for which the lower bound becomes 


dip = dip + {w - (2 — Rank (В„+;)) + 1}, there is no contribution to the lower 
bound. 


Let the collection of full rank-reduced echelon matrices be denoted by, as before, 
G = Гб. GO : Go. and let g’ denote the collection of M rank matri- 


sys? M sys? Sys 
ces with overlapping information sets 7% = iG Go, as ci Me All 


m + M generator matrices are needed by the [25] algorithm. Clearly, if the con- 
dition w > k — Rank (Bins i) is never satisfied throughout the enumeration, the 
corresponding generator matrix contributes nothing to the lower bound and, hence, 
can be excluded [11]. In order to accommodate this improvement, we need to know 
Wmax the maximum information weight that would need to be enumerated before the 
minimum distance is found. This can be accomplished as follows: Say at information 
weight у, a lower weight codeword is found, i.e. new d, starting from w’ = w, we let 
KX = G', set dp = m(w' + 1) and then increment it by (w' — (k — Rank (B m+;)) + 1) 
for each matrix in 7% that satisfies и’ > k — Rank (By zh Each matrix that satisfies 
this condition is also excluded from Z^. The weight и” is incremented, dj; is recom- 
puted and at the point when dj, > dup, we have wmax and all matrices іп 2 are those 
to be excluded from codeword enumeration. 

In some cases, it has been observed that while enumerating codewords of informa- 
tion weight w, a codeword, whose weight coincides with the lower bound obtained at 
enumeration step w — 1, appears. Clearly, this implies that the newly found codeword 
is indeed a minimum weight codeword; any other codeword of lower weight, if they 
exist, would have been found in the earlier enumeration steps. This suggests that the 
enumeration at step w may be terminated immediately. Since the bulk of computation 
time increases exponentially as the information weight is increased, this termination 
may result in a considerable saving of time. 

Without loss of generality, we can assume that Rank(B,,+;) > Rank(Bm+j+1). 
With this consideration, we can implement the Zimmermann approach to minimum 
distance evaluation of linear code over F,—with the improvements, in Algorithm 5.1. 
The procedure to update Wmax and .2 is given in Algorithm 5.2. 

If there is additional code structure, the computation time required by Algo- 
rithm 5.1 can be reduced. For example, in some cases it is known that the binary 
code considered has even weight codewords only, then at the end of codeword enu- 
meration at each step, the lower bound а), that we obtained may be rounded down 
to the next multiple of 2. Similarly, for codes where the weight of every codeword 
is divisible by 4, the lower bound may be rounded down to the next multiple of 4. 


5.2.4 Chen's Algorithm for Cyclic Codes 


Binary cyclic codes, which were introduced by Prange [19], form an important 
class of block codes over F2. Cyclic codes constitute many well-known error- 
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Algorithm 5.1 Minimum distance algorithm: improved Zimmermann's approach 


Input: 4 = |600,6... GUY | where || = т 
Input: #' = (6), Gt aon) where || = M 
Output: d (minimum distance) 
1: а <= dub < Wmax < К 
2: dp <w < 1 
3: Ж =й 
4: repeat 
5 М < М – |.| 
6: огай? € F5 where мін (i) = w do 
7 for 1 < j < т do 
8: а < wig: GÀ) 
9: if d! < dy» then 


10: dup < а 

11: if dub < dip then 

12: Goto Step 36 

13: end if 

14: Wmax, & < Update wmax and 27 (dus. k,m, А 
15: end if 

16: end for 

17: for 1 < j < M do 

18: а — wig: Go) 

19: Ға” < d,; then 

20: dub < а 

21: if dap < dj; then 

22: Goto Step 36 

23: end if 

24: Wmax, X < Update Wmax and 27 (dub, k,m, А 
25: end if 

26: end for 

27: end for 


28: dip <= m(w + 1) 
29: for 1 < j < M do 


30: ifw> {k — Rank (Bn+j)} then 

31: dip = dip + {w — (k — Rank (Bm+j)) +1} 
32: end if 

33: end for 


34: w<w+l 
35: until dj; > dup OR w > k 
36: d <= dub 


correcting codes, such as the quadratic-residue codes and the commonly used in 
practice Bose-Chaudhuri-Hocquenghem (BCH) and Reed-Solomon (RS) codes. A 
binary cyclic code of length n, where n is necessarily odd, has the property that 
if c(x) = 97 cix, where c; € F, is a codeword of the cyclic code, then x/c(x) 
(mod x" — 1), for some integer j, is also a codeword of that cyclic code. That is to say 
that the automorphism group of a cyclic code contains the coordinate permutation 
i — i+ 1 (mod n). 
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Algorithm 5.2 Wmax, 2 = Update Wmax and X (dup, k, m, 4") 
Input: dub, k, т 


Input: 9’ {ass Dem vc aM | 
Output: Wmax and 2 

п 

2: Wmax < 1 

3: repeat 


4: dip < m(Wmax + 1) 


2: for 1 < j x |4'| do 

6: if Wmax > {к — Rank (Bn+j)} then 

7: Remove єт P from X if GE DEY 

8: dip = dip 4 {Wmax (k Rank (Bm+;)) + 1} 
9: end if 
10: end for 
11: Wmax < Wmax +1 


12: until dj > dup OR Wmax > k 
13: return Wmax and 27 


An [n, k, d] binary cyclic code is defined by a generator polynomial g(x) of degree 
n — К, and a parity-check polynomial h(x) of degree К, such that g(x)h(x) = 0 
(mod x" — 1). Any codeword of this cyclic code is a multiple of g(x), that is c(x) — 
u(x)g(x), where u(x) is any polynomial of degree less than k. The generator matrix 
G can be simply formed from the cyclic shifts of g(x), i.e. 


g(x) (mod x” — 1) 
xg(x) (mod x” — 1) 


(5.4) 
x* Lex) (mod x" — 1) 

Since for some integer i, x! = qi (x)g (x) + r; (х) where r;(x) = хі (mod g(x)), we 

can write 


x* (ZH — rn gyi (x) = хд (х) g(x) 


and based on this, a reduced-echelon generator matrix G,,, of a cyclic code is 
obtained: 


—x"-* (mod g(x) 


—x"-*! (mod g(x)) 
б.» = Tk —x" (mod g(x) | (5.5) 


=x"! (mod g(x)) 
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The matrix G,,, in (5.5) may contain several mutually disjoint information sets. 
But because each codeword is invariant under a cyclic shift, a codeword generated 
by information set .7; can be obtained from information set J; by means of a 
simple cyclic shift. For ар [n, k, d] cyclic code, there always exists |n/k] mutually 
disjoint information sets. As a consequence of this, using a single information set is 
sufficient to improve the lower bound to [п/к | (и + 1) at the end of enumeration 
step w. However, Chen [7] showed that this lower bound could be further improved 
by noting that the average number of non-zeros of a weight wo codeword in an 
information set is wok/n. After enumerating У," , (5 codewords, we know that the 
weight of a codeword restricted to the coordinates specified by an information set is 
at least w + 1. Relating this to the average weight of codeword in an information set, 
we have an improved lower bound of dj; = [ (w+ 1)n/K]. Algorithm 5.3 summarises 
Chen's [7] approach to minimum distance evaluation of a binary cyclic code. Note 
that Algorithm 5.3 takes into account the early termination condition suggested in 
Sect. 5.2.3. 


Algorithm 5.3 Minimum distance algorithm for cyclic codes: Chen's approach 
Input: Gsys = ПРІ {see (5.5)} 
Output: d (minimum distance) 
1: dup < k 
2: dip <-1 
3: у < 1 
4: repeat 
5: а <= к 
6 
7 
8 


for all i € FS where wty (i) = w do 
а <= мін( Gsys) 
Ға” <а,, then 


9: а, < а 
10: if d, < 4, then 
11: Goto Step 18 
12: end if 
13: end if 
14: end for 


15: dde ЕС 1| 
16: w<wt+tl 

17: until dj; > dj; ОВ у > К 
18: d <= dub 


It is worth noting that both minimum distance evaluation algorithms of Zimmer- 
mann [25] for linear codes and that of Chen [7] for cyclic codes may be used to 
compute the number of codewords of a given weight. In evaluating the minimum 
distance d, we stop the algorithm after enumerating all codewords having informa- 
tion weight i to уу, where w is the smallest integer at which the condition dj, > d is 
reached. To compute the number of codewords of weight d, in addition to enumer- 
ating all codewords of weight i to w in their information set, all codewords having 
weight w+ 1 in their information set, also need to be enumerated. For Zimmermann's 
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method, we use all of the available information sets, including those that overlap, 
and store all codewords whose weight matches d. In contrast to Chen's algorithm, 
we use only a single information set but for each codeword of weight d found, we 
accumulate this codeword and all of the п — 1 cyclic shifts. In both approaches, it 
is necessary to remove the doubly-counted codewords at the end of the enumeration 
stage. 


5.2.5 Codeword Enumeration Algorithm 


The core of all minimum distance evaluation and codeword counting algorithms lies 
in the codeword enumeration. Given a reduced-echelon generator matrix, codewords 
can be enumerated by taking linear combinations of the rows in the generator matrix. 
This suggests the need for an efficient algorithm to generate combinations. 

One of the most efficient algorithm for this purpose is the revolving-door algo- 
rithm, see [4, 13, 17]. The efficiency of the revolving-door algorithm arises from 
the property that in going from one combination pattern to the next, there is only 
one element that is exchanged. An efficient implementation of the revolving-door 
algorithm is given in [13], called A/gorithm R, which is attributed to 1812 

Іп many cases, using a single-threaded program to either compute the minimum 
distance, or count the number of codewords of a given weight, of a linear code may 
take a considerable amount of computer time and can take several weeks. 

For these long codes, we may resort to a multi-threaded approach by splitting 
the codeword enumeration task between multiple computers. The revolving-door 
algorithm has a nice property that allows such splitting to be neatly realised. Let 
d;d; | ...d2a,, Where a, > а; >... > аҙ > a, be a pattern of an ¢ out of 
5 combinations-C;. A pattern is said to have rank i if this pattern appears as the 
(i + 1)th element in the list of all С? combinations.^ Let КапК(а,а,_|... азау) be 
the rank of pattern а,а/-1...4241, the revolving-door algorithm has the property 
that [13] 


a; +1 


Rank(a;a; ;...a201) = ( Р 


) - ] — КапК(а,1...ага1) (5.6) 


and, for each integer М, where 0 < N < C) — 1, we can represent it uniquely 
with an ordered pattern а,а,-1...а2а1. As an implication of this and (5.6), if all 


(5 codewords need to be enumerated, we сап split the enumeration into 1 /M | 
blocks, where in each block only at most M codewords need to be generated. In 


3This is the version that the authors implemented to compute the minimum distance and to count 
the number of codewords of a given weight of a binary linear code. 


^Here it is assume that the first element in the list of all C * combinations has rank 0. 
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C; 
Rank Q5 ад аз Q2 а] 
0 43210 5 
Ci 1 |54210 C$ 
Rank јол аза а 2 54320 C$ 
0 |3210 e 8 (5482921 5 
1 |4310 4 |54810 
2 |4391 РС 5 |53210 
3 4320 6 165210 
4 4210 7 165320 
5 |5410 8 165321 
6 |5421 9 |65310 
7 5420 ^ 10 |65430 PROS 
8 5432 11 165431 
9 |5431 12 |65432 
10 |5430 13 |65490 
11 |5310 14 |65421 
12 |5321 15 |65410 
13 |5320 16 (649210 
14 |5210 17 |64320 
18 64321 
19 |64310 
20 22 


Fig. 5.1 c$ and C 1 revolving-door combination patterns 


this way, we can do the enumeration of each block on a separate computer and this 
allows a parallelisation of the minimum distance evaluation, as well as the counting 
of the number of codewords of a given weight. We know that at the ith block, the 
enumeration would start from rank (i — 1)M, and the corresponding pattern can be 
easily obtained following (5.6) and Lemma 5.1 below. 

АП a;à;—1...a2a; revolving-door patterns of С; satisfy the property that if the 
values in position a; grow in an increasing order, then for fixed a;, the values in 
position а; grow in a decreasing order, moreover for fixed а,а,-і the values in 
position а; 2 grow in an increasing order, and so on in an alternating order. This 
behaviour is evident by observing all revolving-door patterns of С (left) and Сі 
(right) shown in Fig.5.1. 
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From this figure, we can also observe that 
C Ow c ou E (5.7) 


and this suggests the following lemma. 


Lemma 5.1 (Maximum and Minimum Ranks) Consider the a;a;.4...a5d4 
revolving-door combination pattern, if we consider patterns with fixed a,, the maxi- 
mum and minimum ranks of such pattern are respectively given by 


1 
(^ T ) = 1 апа (“) , 
t t 
Example 5.2 (Maximum and Minimum Ranks) Say, if we consider all С? revolving- 
door combination patterns (left portion of Fig.5.1) where a4 — 4. From Lemma 5.1, 


we have a maximum rank of Q — 1 = 4, and a minimum rank of 6 — 1. We сап 
see that these rank values are correct from Fig. 5.1. 


Example 5.3 (The Revolving-Door Algorithm) Consider combinations CZ generated 
by the revolving-door algorithm, we would like to determine the rank of combina- 
tion pattern 17. We know that the combination pattern takes the ordered form of 
d5d403025,, Where a; > а; 1. Starting from as, which can takes values from 0 to 
6, we need to find as such that the inequality (3) < 17 < (©) — ] is satisfied 


5 
(Lemma 5.1). It follows that as = 6 and using (5.6), we һауе 


17- Rank(6a4a3a2a,) 
6+1 
= ( р ) - ] — КапК(адаҙага|) 
Rank(a4a3a5a;) = 20 – 17 = 3. 


Next, we consider a4 and as before, we need to find a4 є {5, 4, 3, 2, 1, O} such 
that the inequality (<i) < ВапК(адазаға|) < (E) — 1 is satisfied. It follows that 
a4 = 4 and from (5.6), we have 


3 = КапК(4азаза\) 


— uw ) = 1 — КапК(азаза\) 


Rank(aaa2a,) =4-3=1. 


Next, we need to find a3, which can only take a value less than 4, such that the 


inequality (2) < Rank(a3a2a) < | ') — ] is satisfied. It follows that аз = 3 and 


from (5.6), Rank(a;a;) = le = 1 фаза 
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So far we have 643а2а1, only аҙ and a, are unknown. Since аз = 3, аҙ can only 
take a value less than 3. The inequality (2) < Rank(aoai) < а 4 — ] is satisfied 


if a2 = 2 and correspondingly, Rank(a,) = ies - Ц —2 = 0. 


For the last case, the inequality (1) x Rank(aj) < Cy) — 1 is true if and 
only if a; = 0. Thus, we have 64320 as the rank 17 C7 revolving-door pattern. 


Cross-checking this with Fig. 5.1, we can see that 64320 is indeed of rank 17. 


From (5.6) and Example 5.3, we can see that given a rank М, where 0 < N < 
ы — 1, we can construct an ordered pattern of С? revolving-door combinations 
d;0;—| ... a241, recursively. A software realisation of this recursive approach is given 


in Algorithm 5.4. 


Algorithm 5.4 Recursively Compute a; (Rank(ajq;_| ...аза]), i) 
Input: i and Rank(ajaj ., ...a5a1) 
Output: a; 
1: Find aj, where 0 < а; < агі, such that (%) < Rank(ajaj_| . . . a241) < lee Е 1] 
2: if i > i then 
3 Compute КапК(а;-1...о4а- (Өң - 1] — Rank(ajaj; 1 . . . a241) 
4: RecursiveCompute a; (Rank(aj—1 ...a2a1), i — 1) 
5: end if 
6: return aj 


5.3 Binary Cyclic Codes of Lengths 129 < п < 189 


The minimum distance of all binary cyclic codes of lengths less than or equal to 99 
has been determined by Chen [7, 8] and Promhouse et al. [21 ]. 

This was later extended to longer codes with the evaluation of the minimum 
distance of binary cyclic codes of lengths from 101 to 127 by Schomaker et al. 
[22]. We extend this work to include all cyclic codes of odd lengths from 129 to 
189 in this book. The aim was to produce a Table of codes as a reference source 
for the highest minimum distance, with the corresponding roots of the generator 
polynomial, attainable by all cyclic codes over F, of odd lengths from 129 to 189. 
It is well known that the coordinate permutation o : i — ші, where и is an integer 
relatively prime to n, produces equivalent cyclic codes [3, p. 141f]. With respect to 
this property, we construct a list of generator polynomials g (x) of all inequivalent and 
non-degenerate [16, p. 223f] cyclic codes of 129 « n < 189 by taking products of the 
irreducible factors of x" — 1. Two trivial cases are excluded, namely g(x) = x + 1 
and g(x) = (x" — 1)/(x 4- 1), since these codes have trivial minimum distance 
and exist for any odd integer n. The idea is for each g(x) of cyclic codes of odd 
length п; the systematic generator matrix is formed and the minimum distance of 
the code is determined using Chen's algorithm (Algorithm 5.3). However, due to 
the large number of cyclic codes and the fact that we are only interested in those of 
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largest minimum distance for given n апа К, we include a threshold distance 4, in 
Algorithm 5.3. Say, for given n and К, we have a list of generator polynomials g (x) of 
all inequivalent cyclic codes. Starting from the top ofthe list, the minimum distance of 
the corresponding cyclic code is evaluated. If a codeword of weight less than or equal 
to dın is found during the enumeration, the computation is terminated immediately 
and the next g(x) is then processed. The threshold d;;, which is initialised with 0, is 
updated with the largest minimum distance found so far for given n and К. 

Table 4.3 in Sect. 4.5 shows the highest attainable minimum distance of all binary 
cyclic codes of odd lengths from 129 to 189. The number of inequivalent and non- 
degenerate cyclic codes for a given odd integer п, excluding the two trivial cases 
mentioned above, is denoted by Ме. 

Note that Table 4.3 does not contain entries for primes n = 8m +3. This is because 
for these primes, 2 is not a quadratic residue modulo n and hence, ordz (n) = n — 1. 
As a consequence, x" — 1 factors into two irreducible polynomials only, namely х + 1 
and (x" — 1)/(x + 1) which generate trivial codes. Let В be a primitive nth root of 
unity, the roots of g(x) of a cyclic code (excluding the conjugate roots) are given 
in terms of the exponents of 8. The polynomial m(x) is the minimal polynomial of 
P and it is represented in octal format with most significant bit on the left. That is, 
m(x) = 166761, as in the case for n = 151, represents x? + x!^ + x P 4 x! + 
x10 x8 p x? p x6 E x? txt +1. 


5.4 Some New Binary Cyclic Codes Having Large 
Minimum Distance 


Constructing an [n, К] linear code possessing the largest minimum distance is one of 
the main problems in coding theory. There exists a database containing the lower and 
upper bounds of minimum distance of binary linear codes of lengths 1 « n « 256. 
This database appears in [6] and the updated version is accessible online.? 

The lower bound corresponds to the largest minimum distance for a given [n, k], 
code that has been found to date. Constructing codes which improves Brouwer's 
lower bounds is an on-going research activity in coding theory. Recently, Tables of 
lower- and upper-bounds of not only codes over finite-fields, but also quantum error- 
correcting codes, have been published by Grassl [12]. These bounds for codes over 
finite-fields, which are derived from MAGMA [5], appear to be more up-to-date than 
those of Brouwer. 

We have presented in Sect. 5.3, the highest minimum distance attainable by all 
binary cyclic codes of odd lengths from 129 to 189 and found none of these cyclic 
codes has larger minimum distance than the corresponding Brouwer's lower bound 
for the same n and К. The next step is to consider longer length cyclic codes, 191 < 


>The database is available at http://www.win.tue.nl/~aeb/voorlincod.html. 
Note that, since 12/8 March 2007, A. Brouwer has stopped maintaining his database and hence 
it is no longer accessible. This database is now superseded by the one maintained by Grassl [12]. 
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n < 255. For these lengths, unfortunately, we have not been able to repeat the 
exhaustive approach of Sect. 5.3 in a reasonable amount of time. This is due to the 
computation time to determine the minimum distance of these cyclic codes and also, 
for some lengths (e.g. 195 and 255), there are a tremendous number of inequivalent 
cyclic codes. Having said that, we can still search for improvements from lower rate 
cyclic codes of these lengths for which the minimum distance computation can be 
completed in a reasonable time. We have found many new cyclic codes that improve 
Brouwer's lower bound and before we present these codes, we should first consider 
the evaluation procedure. 

As before, let 8 be a primitive nth root of unity and let A be a set containing 
all distinct (excluding the conjugates) exponents of В. The polynomial x" — 1 can 
be factorised into irreducible polynomials f;(x) over Е, х" — 1 = []je, fix). 
For notational purposes, we denote the irreducible polynomial f; (х) as the minimal 
polynomial of 8’. The generator and parity-check polynomials, denoted by g(x) and 
h(x) respectively, are products of f; (х). Given aset ГС A, acyclic code @ which 
has В‘, i € Г, as ће non-zeros сап be constructed. This means the parity-check 
polynomial h(x) is given by 


h(x) =|] 4o» 


ier 


and the dimension К of this cyclic code is У, er deg( fi (x)), where deg( f (x)) denotes 
the degree of f (x). Let I" с AX {0}, A'(x) = [hier Л О) and h(x) = (1+ x)A' (x). 
Given @ with parity-check polynomial A (x), there exists an [n, k — 1, d'] expurgated 
cyclic code, @’, which has parity-check polynomial h'(x). For this cyclic code, 
wty(c) = 0 (mod 2) for all с € ©. For convenience, we call @ the augmented 
code of 6”. 

Consider an [n, k — 1, d'] expurgated cyclic code ©, let the set Г = (11, Г», 
..., I} where, for 1 < j < r, T; € A \ {0} and Э ек deg(f;(x)) = k — 1. For 
each Г; є Г, месотрше h'(x) and construct €". Having constructed the expurgated 
code, the augmented code can be easily obtained as shown below. Let G be a generator 
matrix of the augmented code @, and without loss of generality, it can be written as 


С = d (5.8) 


у 


where С” is a generator matrix of @’ and the vector v is a coset of @’ in @. Using 
the arrangement in (5.8), we evaluate а” by enumerating codewords c € @’ from G’. 
The minimum distance of @, denoted by d, is simply тіп, с«{4', wtg (c + v)) for 
all codewords с enumerated. We follow Algorithm 5.3 to evaluate d’. Let dg-ouwer 
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and 4): denote the lower bounds of [6] for linear codes of the same length and 
dimension as those of @ and %” respectively. During the enumerations, as soon as 
d < dBrouwer and 4” < 4}, „орх the evaluation is terminated and the next Г; in Г 
is then processed. However, if d < dBrouwer and 4” > “р, only the evaluation 
for @ is discarded. Nothing is discarded if both а” > dhrouwer and d > dBrouwer- 
This procedure continues until an improvement is obtained; or the set in Г has been 
exhausted, which means that there does not exist [n, k — 1] and [n, k] cyclic codes 
which are improvements to Brouwer's lower bounds. In cases where the minimum 
distance computation is not feasible using a single computer, we switch to a parallel 
version using grid computers. 

Table5.1 presents the results of the search for new binary cyclic codes having 
lengths 195 « n < 255. The cyclic codes in this table are expressed in terms of the 
parity-check polynomial h(x), which is given in the last column by the exponents of 
P (excluding the conjugates). Note that the polynomial m (x), which is given in octal 
with the most significant bit on the left, is the minimal polynomial of В. In many 
cases, the entries of @ and @’ are combined in a single row and this is indicated by 
“a/b” where the parameters a апа b are for %” and @, respectively. The notation 
"[0]" indicates that the polynomial (1 + x) is to be excluded from the parity-check 
polynomial of 6”. 

Some of these tabulated cyclic codes have a minimum Hamming distance which 
coincides with the lower bounds given in [12]. These are presented in Table5.1 with 
the indicative mark “+”. 

Inthelate 1970s, computing the minimum distance of extended Quadratic Residue 
(QR) codes was posed as an open research problem by MacWilliams and Sloane [16]. 
Since then, the minimum distance of the extended QR code for the prime 199 has 
remained an open question. For this code, the bounds of the minimum distance were 
given as 16 — 32 in [16] and the lower bound was improved to 24 in [9]. Since 
199 = —1 (mod 8), the extended code is a doubly even self-dual code and its 
automorphism group contains a projective special linear group, which is known to 
be doubly transitive [16]. As a result, the minimum distance of the binary [199, 100] 
QR code is odd, i.e. d = 3 (mod 4), and hence, d = 23, 27 or 31. Due to the cyclic 
property and the rate of this QR code [7], we can safely assume that a codeword 
of weight d has maximum information weight of |4/2 |. If a weight d codeword 
does not satisfy this property, there must exist one of its cyclic shifts that does. After 
enumerating all codewords up to (and including) information weight 13 using grid 
computers, no codeword of weight less than 31 was found, implying that d of this 
binary [199, 100] OR code is indeed 31. 

Without exploiting the property that d - 3 (mod 4), an additional (10 4 ) + (О) 
codewords (88,373,885,354,647,200 codewords) would need to be enumerated іп 
order to establish the same result and beyond available computer resources. Accord- 
ingly, we now know that there exists the [199, 99, 32] expurgated QR code and the 
[200, 100, 32] extended QR code. 

It is interesting to note that many of the code improvements are contributed by 
low-rate cyclic codes of length 255 and there are 16 cases of this. Furthermore, it is 
also interesting that Table 5.1 includes a [255, 55, 70] cyclic code and a [255, 63, 65] 
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Table 5.1 New binary cyclic codes 
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[m(x)]g n k d dBrouwer h(x) 

17277 195 * 66/67 42/41 40/40 [0], 3, 5, 9, 19, 39, 65, 67 
* 68/60 40/39 39/38 [0], 1, 3, 13, 19, 35, 67, 91 
*7 38 37 0, 3, 7,19, 33, 35, 47 
% 74/75 38/37 36/36 [0], 3, 7, 19, 33, 35, 47, 65 
78 36 35 3,7,9,11,19,35,39,65 

13237042705- 199 99/100 32/31 28/28 [0], 1 

30057231362- 

555070452551 

6727273 205 * 60 48 46 5,11,31 
761 46 44 0,3,11,31 

3346667657 215 70/71 46/46 44/44 [0], 3, 13, 35 

3705317547055 223 74/75 48/47 46/45 [0], 5, 9 

3460425444467- 229 76 48 46 1 

7544446504147 

6704436621 233 % 58/59 60/60 56/56 [0], 3, 29 

150153013 241 * 49 68 65 0,1,21 
73 54 53 0,1,3,25 

435 255 48/49 76/15 75/72 [0], 47, 55, 91,95, 111, 127 
50/51 74/74 72/72 [0], 9, 13, 23, 47, 61, 85, 127 
52/53 72/72 71/68 [0], 7, 9, 17, 47, 55, 111, 127 
54/55 70/70 68/68 [0], 3, 7, 23, 47, 55, 85, 119, 127 
56/57 68/68 67/65 [0], 7, 27, 31, 45, 47, 55, 127 
58 66 64 7, 39, 43, 45, 47, 55, 85, 127 
60 66 64 7, 17, 23, 39, 45, 47, 55, 127 
62/63 66/65 64/63 [0], 11, 21, 47, 55, 61, 85, 87, 119, 127 
64/65 64/63 62/62 [0], 19, 31, 39, 47, 55, 63, 91, 127 


cyclic code, which are superior to the BCH codes of the same length and dimension. 
Both of these BCH codes have minimum distance 63 only. 


5.5 Constructing New Codes from Existing Ones 


It is difficult to explicitly construct a new code with large minimum distance. How- 
ever, the alternative approach, which starts from a known code which already has large 
minimum distance, seems to be more fruitful. Some of these methods are described 
below and in the following subsections, we present some new binary codes con- 
structed using these methods, which improve on Brouwer’s lower bound. 


Theorem 5.1 (Construction X) Let Z, and B- be [n, kı, dı] and [n, Ко, d2] linear 
codes over F} respectively, where Bı D By (Bz is a subcode of Bı). Let A 
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be an [n', кз = kı — ko, d'] auxiliary code over the same field. There exists an 
[n +n’, kı, min{d2, dj + d')] code х over Fy. 


Construction X is due to Sloane et al. [23] and it basically adds a tail, which is a 
codeword of the auxiliary code 7, to | so that the minimum distance is increased. 
The effect of Construction X can be visualised as follows. Let G« be the generator 
matrix of code Є. Since 4, 5 Ar, we may express Gg, as 


where V is a (kı — k2) x n matrix which contains the cosets of ZZ; іп |. We can see 
that the code generated by Gg, has minimum distance d», and the set of codewords 
{у + c2}, for all v є V and all codewords с> generated by Gg,, have minimum 
weight of dı. By appending non-zero weight codewords of & to the set (v + c5], 
and all zeros codeword to each codeword of 42, we һауе a lengthened code of larger 
minimum distance, x, whose generator matrix is given by 


Ge, = Ga, ER (5.9) 


y EX 


We can see that, for binary cyclic linear codes of odd minimum distance, code 
extension by annexing an overall parity-check bit is an instance of Construction X. 
In this case, 2; is the even-weight subcode of | and the auxiliary code . is the 
trivial |1,1, Гр code. 

Construction X given in Theorem 5.1 considers a chain of two codes only. There 
also exists a variant of Construction X, called Construction XX, which makes use of 
Construction X twice and it was introduced by Alltop [1]. 


Theorem 5.2 (Construction XX) Consider three linear codes of the same length, 
Фу = [n, ki, di], Ф = [n, k2, d2] and Фа = [n, Кз, d3] where Bı C Bı and 
Bz C Bı. Let By Бе an [n, ка, d4] linear code which is the intersection code of 
By and 23, i.e. By = Bı By. Using auxiliary codes ой = [ny, ky — ky, 4] and 
4 = [n2, kı — Ks, d5], there exists an [n + nı + m, kı, d] linear code €x x, where 
d = min{d4, d3 + dj, d2 + d}, di + dj + db}. 


The relationship among 4, 4», 3 and 4 can be illustrated as a lattice shown 
below [11]. 
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Since 20 D 2, Bı D B3, By C Bı and Ay С Fs, the generator matrices of 
By, Bz and 2 can be written as 


Gg, = Ga, , Ga,= 


У, V3 


and Gg, = 


respectively, where V;, i = 2,3, is the coset of 24 іп Ži, and V contains the 
cosets of 2, and 23 іп 2]. Construction XX starts by applying Construction X to 
the pair of codes 2) > A> using ой as the auxiliary code. The resulting code is 
6x = [n + ni, kı, min(d», dı + «|Н, whose generator matrix is given by 


Ga, | 0 
Gex = V2 
V3 
С ол 
V 


This generator matrix can be rearranged such that the codewords formed from the 
first n coordinates are cosets of 23 in 4. This rearrangement results in the following 
generator matrix of х, 


Ga, |0 

бе =| БЕЛЕСІ 
V |0 
у |6® 
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a) 
= . Next, using &% as the auxiliary code, applying Construction 


where Ga = | —5 
G 


1 
X tothe pair Z, > A; with the rearrangement above, we obtain @у x whose generator 
matrix is 


While Constructions X and XX result in a code with increased length, there also 
exists a technique to obtain a shorter code with known minimum distance lower 
bounded from a longer code whose minimum distance and also that of its dual code 
are known explicitly. This technique is due to Sloane et al. [23] and it is called 
Construction ҮІ. 


Theorem 5.3 (Construction Y1) Given an [n, К, d] linear code ©, which has an 
[n,n — k, d^] €+ as its dual, an [n — d^, k — d^ + 1, » d] code © can be 
constructed. 


Given an [n, К, d] code, with standard code shortening, we obtain an [n — i, k — i, 
> d] code where i indicates the number of coordinates to shorten. With Construction 
ҮІ, however, we can gain an additional dimension in the resulting shortened code. 
This can be explained as follows. Without loss of generality, we can assume the 
parity-check matrix of Є, which is also the generator matrix of @+, Н contains 
a codeword c+ of weight d+. If we delete the coordinates which form the support 
of c+ from Н, now Н becomes an (n — k) x n — d. matrix and there is a row 
which contains all zeros among these n — k rows. Removing this all zeros row, we 
have an (n — k — 1) x (n — d^) matrix H', which is the parity-check matrix of an 
[n — dt,n — dt — (n — k — 1), > d] = [n — dt, k — d+ + 1, > d] code €". 


5.5.1 New Binary Codes from Cyclic Codes of Length 151 


Amongst all of the cyclic codes in Table 4.3, those of length 151 have minimum 
distances that were found to have the highest number of matches against Brouwer's 
[6] lower bounds. This shows that binary cyclic codes of length 151 are indeed good 
codes. Since 151 is a prime, cyclic codes of this length are special as all of the 
irreducible factors of x^! — 1, apart from 1 + x, have a fixed degree of 15. Having 
a fixed degree implies that duadic codes [14], which includes the quadratic residue 
codes, also exist for this length. Due to their large minimum distance, they are good 
candidate component codes for Constructions X and XX. 
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Table 5.2 Order of В in an optimum chain of [151, k;, di] cyclic codes 


ki dj Roots of g(x), excluding conjugate roots 
1502 В? 

1356 898! 

1208 £9 в! в? 

105 14 80 В! g? p> 

90 18 p? В! p? 8° pl 

75 24 Во в! ВЗ 85 p pi^ 

60 32 Во в! 83 85 p pls p? 
45 36 p? В! p? 8° p p^ p? p?! 
30 48 p? В! 83 g^ Ві! pi^ g2 g35 вэ? 
10 15 60 B° В! 83 85 В? gll BIS g23 g35 837 


© 00-10 олыо мыо YI] 


Definition 5.2 (Chain of Cyclic Codes) A pair of cyclic codes, @ = [n, kı, di] 
and % = [n, kx, do] where Кү > Ко, is nested, denoted “4 D 6, if all roots of 
© are contained in 62. Here, the roots refer to those of the generator polynomial. 
By appropriate arrangement of their roots, cyclic codes of the same length may be 
partitioned into a sequence of cyclic codes 44 D 6 D ... D Ф. This sequence of 
codes is termed a chain of cyclic codes. 


Given all cyclic codes of the same length, it is important to order the roots of 
these cyclic codes so that an optimum chain can be obtained. For all cyclic codes of 
length 151 given in Table 4.3, whose generator polynomial contains 1 + x as a factor, 
an ordering of roots (excluding the conjugate roots) shown in Table 5.2 results in 
an optimum chain arrangement. Неге В is a primitive 1518! root of unity. Similarly, 
a chain which contains cyclic codes, whose generator polynomial does not divide 
1 + х, can also be obtained. 

All the constituent codes in the chain Ф D 62 D ... D Фо of Table 5.2 are cyclic. 
Following Grassl [10], a chain of non-cyclic subcodes may also be constructed from 
a chain of cyclic codes. This is because for a given generator matrix of an [n, k, d] 
cyclic code (not necessarily in row-echelon form), removing the last i rows of this 
matrix will produce an [n, k — i, > 4] code which will no longer be cyclic. As 
a consequence, with respect to Table5.2, there exists [151, К, d] linear codes, for 
15 < k x 150. 

Each combination of pairs of codes in the [151, k, d] chain is a nested pair which 
can be used as component codes for Construction X to produce another linear code 
with increased distance. There is a chance that the minimum distance of the resulting 
linear code is larger than that of the best-known codes for the same length and 
dimension. In order to find the existence of such cases, the following exhaustive 
approach has been taken. There are [Oo - (2) distinct pair of codes in ће 
above chain of linear codes, and each pair say @ = [n, kı, di] D © = [n, k2, di], is 
combined using Construction X with an auxiliary code 7, which is an [n’, kı — 0, d'] 
best-known linear code. The minimum distance of the resulting code бұ is then 
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compared to that of the best-known linear code for the same length and dimension 
to check for a possible improvement. Two improvements were obtained and they are 
tabulated in in the top half of Table 5.3. 

In the case where kı — k2 is small, the minimum distance of 64, i.e. dı, obtained 
from a chain of linear codes, can be unsatisfactory. We can improve d; by augmenting 
© with a vector v of length n, i.e. add v as an additional row in G¢,. In finding a vector 
v that can maximise the minimum distance of the enlarged code, we have adopted 
the following procedure. Choose a code 6 = [n, k2, 0] that has sufficiently high 
minimum distance. 

Assuming that С, is in reduced-echelon format, generate a vector v which sat- 
isfies the following conditions: 


1. v; = 0 for 0 < i < k — 1 where у; is the ith element of v, 

2. wty(v) > dj, and 

3. мін(У--б,) > dj forallr є (0, 1, ..., к — 1} where С, „ denotes the rth row 
of Go. 


The vector v is then appended to Gg, as an additional row. The minimum distance 
of the resulting code is computed using Algorithm 5.1. A threshold is applied during 
the minimum distance evaluation and a termination is called whenever: d, < d4, in 
which case a different v is chosen and Algorithm 5.1 is restarted; or dı < dub < dip 
which means that an improvement has been found. 

Using this approach, we found two new linear codes, [151, 77, 20] and 
[151, 62, 27], which have higher minimum distance than the corresponding codes 
obtained from a chain of nested cyclic codes. These two codes are obtained start- 
ing from the cyclic code [151, 76, 23]-which has roots (8, B5, 85, Bp», 837) and the 
cyclic code |151, 61, 31]—which has roots (0, 83, 8°, 811, 815, 827) respectively and 
therefore 

[151, 77, 20] > [151, 76, 23] 


and 
[151, 62, 27] > [151, 61,31]. 


The second half of Table5.3 shows the foundation codes for these new codes. 

Note that when searching for the [151, 62, 27] code, we exploited the property 
that the [152, 61, 32] code obtained by extending the [151, 61, 31] cyclic code is 
doubly even. We chose the additional vector v such that extending the enlarged 
code [151, 62, dı] yields again a doubly even code. This implies the congruence 
dı = 0,3 mod 4 for the minimum distance of the enlarged code. Hence, it is sufficient 
to establish a lower bound dj, = 25 using Algorithm 5.1 to show that d; > 27. 

Furthermore, we also derived two different codes, © = [151, 62,27] C G 
апа @ = [151, 62,27] с «€, where 4 = [151], 63, 23] and @% = 6 N G = 
[151, 61, 31]. Using Construction XX, a[159, 63, 31] code is obtained, see Table 5.4. 
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Table 5.3 New binary codes from Construction X and cyclic codes of length 151 


Ф\ % A Cx 
Using chain of linear codes 
[151,72,24] [151,60,32] [23,12,7] [174,72,31] 
[151,60,32] [151,45,36] [20,15,3] [171,60,35] 
Using an improved subcode 
[151,77,20] [151,76,23] [3,1,3] [154,77,23] 
[151,62,27] [151,61,31] [4,1,4] [155,62,31] 


Table 5.4 New binary code from Construction XX and cyclic codes of length 151 
©] % Фз е = © П © A Dy Cxx 
(151, 63, 23] [151,62,27]  [151, 62, 27] [151, 61,31] [4,1,4] [4,1,4] [159,63,31] 


5.5.2 New Binary Codes from Cyclic Codes of Length > 199 


We know from Table5.1 that there exists an outstanding |199, 100, 31] cyclic 
code. The extended code, obtained by annexing an overall parity-check bit, is a 
[200, 100, 32] doubly even self-dual code. As the name implies, being self-dual 
we know that the dual code has minimum distance 32. By using Construction Y1 
(Theorem 5.3), a [168, 69, 32] new, improved binary code is obtained. The minimum 
distance of the [168, 69] previously considered best-known binary linear code is 30. 

Considering cyclic codes of length 205, in addition to a [205, 61, 46] cyclic 
code (see Table 5.1), there also exists а [205, 61, 45] cyclic code which contains 
a [205, 60, 48] cyclic code as its even-weight subcode. Applying Construction X 
(Theorem 5.1) to the [205, 61, 45] > [205, 60, 48] pair of cyclic codes with a repe- 
tition code of length 3 as the auxiliary code, a [208, 61, 48] new binary linear code 
is constructed, which improves Brouwer's lower bound distance by 2. 

Furthermore, by analysing the dual codes of the [255, 65, 63] cyclic code in 
Table5.1 and its [255, 64, 64] even weight subcode it was found that both have 
minimum distance of 8. Applying Construction Y1 (Theorem 5.3), we obtain the 
[247, 57, 64] and the [247, 58, 63] new binary linear codes, which improves on 
Brouwer's lower bound distances by 2 and 1, respectively. 


5.6 Concluding Observations on Producing New Binary 
Codes 


In the search for error-correcting codes with large minimum distance, having a fast, 
efficient algorithm to compute the exact minimum distance of a linear code is impor- 
tant. The evolution of various algorithms to evaluate the minimum distance of a binary 
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linear code, from the naive approach to Zimmermann's efficient approach, have been 
explored in detail. In addition to these algorithms, Chen's approach in computing 
the minimum distance of binary cyclic codes is a significant breakthrough. 

The core basis of a minimum distance evaluation algorithm is codeword enumer- 
ation. As we increase the weight of the information vector, the number of codewords 
grows exponentially. Zimmermann's very useful algorithm may be improved by 
omitting generator matrices with overlapping information sets that never contribute 
to the lower bound throughout the enumeration. Early termination is important in 
the event that a new minimum distance is found that meets the lower bound value of 
the previous enumeration step. In addition, if the code under consideration has the 
property that every codeword weight is divisible by 2 or 4, the number of codewords 
that need to be enumerated can be considerably reduced. 

With some simple modifications, these algorithms can also be used to collect and 
hence, count all codewords of a given weight to determine all or part of the weight 
spectrum of a code. 

Given a generator matrix, codewords may be efficiently generated by taking linear 
combinations of rows of this matrix. This implies the faster we can generate the 
combinations, the less time the minimum distance evaluation algorithm will take. 
One such efficient algorithm to generate these combinations is called the revolving- 
door algorithm. The revolving-door algorithm has a nice property that allows the 
problem of generating combinations to be readily implemented in parallel. Having 
an efficient minimum distance computation algorithm, which can be computed in 
parallel on multiple computers has allowed us to extend earlier research results (8, 
21, 22] in the evaluation of the minimum distance of cyclic codes. In this way, we 
obtained the highest minimum distance attainable by all binary cyclic codes of odd 
lengths from 129 to 189. We found that none of these cyclic codes has a minimum 
distance that exceeds the minimum distance of the best-known linear codes of the 
same length and dimension, which are given as lower bounds in [6]. However there 
аге 134 cyclic codes that meet the lower bounds, see Sect. 5.3 and encoders and 
decoders may be easier to implement for the cyclic codes. 

Having an efficient, multiple computer based, minimum distance computation 
algorithm also allowed us to search for the existence of binary cyclic codes of length 
longer than 189 which are improvements to Brouwer's lower bounds. We found 35 
of these cyclic codes, namely 


[195, 66, 42], [195, 67, 41], [195, 68, 40], |195, 69, 39], [195, 73, 38], [195, 74, 38], 
[195, 75, 37], [195, 78, 36], [199, 99, 32], [199, 100, 32], [205, 60, 48], [205, 61, 46], 
[215, 70, 46], [215, 71, 46], [223, 74, 48], [223, 75, 47], [229, 76, 48], [233, 58, 60], 
(233, 59, 60], [255, 48, 76], [255, 49, 75], [255, 50, 74], [255, 51, 74], [255, 52, 72], 
[255, 53, 72], [255, 54, 70], [255, 55, 70], |255, 56, 68], [255, 57, 68], [255, 58, 66], 
[255, 60, 66], [255, 62, 661, [255, 63, 65], [255, 64, 64], [255, 65, 63]. 


From the cyclic codes above, using Construction X to lengthen the code or Con- 
struction ҮІ to shorten the code, four additional improvements to [6] lower bound 
are found, namely 
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сос |46 МЫ (Ж 5% 5% ме МЕ ote we TE Te | с к PE HE |е v€ SE 9c oc ре (0с 
с |6 Ыы ste 506 мє сє |60 е сє we we о = ve ве tE РЕ 9€ 9€ € |200 
тос lae |6 се (6 CE и МЄ ote мє we ce CE. we we ve ve к ve РЕ 96 Ot | |100 
00-46 |ж 5% 506 gE се |96 CE. сє Ce we lee we CE. ve ve ве РЕ ve se 9€ |е |000 
uly |001 66 86 16 96066 v6 66 26 16 06 |68 88 /8 98 S8 78 єз 178 18 08 |6 Жи 
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Lye 29 сә W 9 1489 109 509 599 99 ;99 19 89 89 89 ш Lye 
9pC 19 сә W 79 29 49 99 59 559 «99 99 19 89 89 oL 9ус 
erc 09 19 79 c9 29 T9 (90 99 oe. 599 99 99 19 89 oL 474 
РРС 66 09 19 c9 29 29 9 £9 st9 v9 59 99 99 89 69 РРС 
Erz ss 6$ 09 19 29 29 29 c9 59 9 79 s9 99 489 89 ere 
vc 85 86 66 09 19 29 29 c9 9 (9 v9 v9 59 489 89 [474 
ic LS 8S 88 09 09 19 29 c9 c9 c9 v9 v9 v9 989 89 lc 
Orc 9с 86 88 09 09 09 19 c9 c9 c9 v9 v9 v9 419 89 orz 
бес 96 Lg 88 409 09 09 09 19 79 79 £9 79 v9 499 19 бес 
SEZ 9с 96 LS 109 109 09 09 09 19 79 29 £9 v9 459: 99 sez 
LET ss 96 9с 109 109 s09 09 09 09 19 29 29 £9 700 99 LEZ 
9£c rs 9g 9% 109 109 509 509 09 09 09 19 29 79 700 69 9€c 
сес rs 66095 109 109 09 509 509 09 09 09 19 c9 £9 #9 SEZ 
rez rs rs 66 109 109 509 09 09 09 09 09 09 19 сә #9 PET 
сес rs rs үс 209 209 509 — 509 09 509 (09 09 09 09 сә #9 сес 
TET rs rs Ұс 465 <09 09 509 509 509 (09 09 09 09 9 9 сес 
IEZ rs v6 {6 485 «68 $09 09 $09 s09 509 $09 09 09 19 £9 IEZ 
oez sts rs {6 ET. 58S 465 509 (09 s09 09 509 509 09 09 c9 oez 
6с sES ee 495 545 85 565 509 s09 09 09 409 ;09 09 c9 6CC 
82% TS М6 +S 496 59S sLS 585$ 566 $09 509 (09 509 09 09 19 8cc 
LUZ TS TS YS rs ees FE $8$ $68 509 09 09 09 09 09 LUZ 
9cc (as TS +S rs rs 655 9e: м5 586 66 509 09 (09 09 09 эсс 
Scc TS TS с үс rs rs 9¢ ос 6058 685 665 09 09 509 09 Scc 
u/y 29 19 09 65 85 LS 9с с̧с rs ES TS Is os 6r sr y\u 
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9S7 
SST 
PST 
EST 
TST 
1$ 
082 
144 
8С 
uf 


599 
599 
599 
<59 
st9 
s£9 
29 
29 
29 
19 


199 
299 
599 
599 
559 
$Ў9 
59 

29 

29 

09 


199 
299 
599 
599 
599 
599 
659 
qv9 
179 

85 


189 
289 
419 
499 
599 
599 
599 
559 
479 

15 


89 
289 
<89 
619 
599 
599 
599 
599 
<59 

9c 


104 
469 
489 
419 
499 
599 
599 
599 

53 


40L 
sOL 
569 
589 
49 
599 
599 
599 

rs 


ui 
oth 
E 
404 
469 
489 
449 
499 
599 

ES 


TL 
Эбі 
«а. 
sIL 
s0L 
s69 
89 
89 
89 
TS 


әрі. 
pb 
JEL 
РАЛ 
ES 
404 
469 

89 

89 

IS 


ЕЛ 
КЛ 
sbL 
КУ 
veh 
glk 
<04 
s69 

89 

0с 


194. 
аў 
КЛ 
sEL 
К? 
gie 
<04 
569 

6t 


9L 
JSL 
vL 
КЛ 
gee 
ZL 
TL 
ZL 
8r 


982 
SST 
YST 
EST 
TST 
IST 
082 
144 
8С 
Nu 


(penunuoo) 8:6 әче], 


5.6 Concluding Observations on Producing New Binary Codes 


133 


Table 5.9 Updated minimum distance lower bounds of linear codes @ = [n, k] for225 < n < 256 
and 63 < k < 76 


n\k| 63 64 | 65 66 67 68 69| 70 71 72 73 74 | 75 76 | k/n 
225| 52 52 | 50 50 50 50 48 | 48 48 48 485 48Е 48E 46 | 225 
226| 52 52 | 50 50 50 50 48 | 48 48 48 485 488 48E 46 | 226 
227| 52 52 | 50 50 50 50 48 | 48 48 48 485 48% 48E 46 | 227 
228| 52 52 | 50 50 50 50 48 | 48 48 48 48 488 48E 47?) 228 
229| 52 52 | 51 50 50 50 49 | 48 48 48 48 48% 48E 48€, 229 
230| 535 52 | 52 51 50 50 50) 48 48 48 48 488) 48E 488) 230 
231| 545 535| 52 52 51 50 50 | 48 48 48 48 48 | 48E 488) 231 
232| 54 545| 535 52 52 51 50 | 49 48 48 48 48 | 48 48Ё| 232 
233| 54 54 | 545 535 52 52 51 | 50 49 48 48 48 | 48 48 | 233 
234| 54 54 | 54 545 535 52 52 | 51 50 49 48 48 | 48 48 | 234 
235| 54 54 | 54 54 545 535 52 | 52 51 50 49 48 48 48 | 235 
236| 54 54 | 54 54 54 545 535| 52 52 51 50 49 | 48 48 | 236 
2371 54 54 | 54 54 54 54 545| 535 52 52 51 50 49 48 | 237 
238| 55 54 | 54 54 54 54 54 | 545 535 52 52 51 50 49 | 238 
239| 56 55 | 54 54 54 54 54 | 54 545 535 52 52 | 51 50 | 239 
240| 56 56 | 54 54 54 54 54 | 54 54 545 s3" 52 | 52 51 | 240 
241| 56 56 | 55 54 54 54 54 54 54 54 54€ 52 | 52 52 | 241 
242| 57 56 | 56 55 54 54 54| 54 54 54 54 53 | 52 52 | 242 
243| 58 57 | 56 56 55 54 54| 54 54 54 54 54 53 52 | 243 
244| 58 58 | 56 56 56 55 54| 54 54 54 54 54 | 54 58 | 244 
245| 59 58 | 57 56 56 56 55 | 54 54 54 54 54 54 54 | 245 
246| 60 59 | 58 57 56 56 56| 55 54 54 54 54 | 54 54 | 246 
2471| 61 60 | 59 58 57 56 56 | 56 55 54 54 54 54 54 | 247 
248| 62 61 | 60 59 58 57 56| 56 56 55 54 54 54 54 | 248 
249| 62 62 | 61 60 59 58 57 | 56 56 56 55 54 | 54 54 | 249 
250| 62 62 | 62 61 60 59 58 | 57 56 56 56 55 | 54 54 | 250 
251| 62 62 | 62 62 61 60 59 | 58 57 56 56 56 | 55 54 | 251 
252| 62 62 | 62 62 62 61 60| 59 58 56 56 56 | 56 55 | 252 
253| 63" 62 | 62 62 62 62 61| 60 59 56 56 56 56 56 | 253 
254| 64" 63"| 62 62 62 62 62 | 61 60 57 56 56 | 56 56 | 254 
255| 65€ 64€0| 63° 62 62 62 62 | 62 61 58 57 56 | 56 56 | 255 
256| 669 648) 64Е 62 62 62 62 | 62 62 58 58 56 | 56 56 | 256 
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[168, 69, 32], [208, 61, 48], [247, 57, 64], [247, 58, 63]. 


Five new linear codes, which are derived from cyclic codes of length 151, have 
also been constructed. These new codes, which are produced by Constructions X 
and XX, are 


[154, 77, 23], [155, 62, 31], [159, 63, 31], [171, 60, 35], [174, 72, 31]. 


Given an [n, k, d] code ©, where d is larger than the minimum distance of the 
best-known linear code of the same n and К, it is possible to obtain more codes, 
whose minimum distance is still larger than that of the corresponding best-known 
linear code, by recursively extending (annexing parity-checks), puncturing and/or 
shortening @. For example, consider the new code |168, 69, 32] as a starting point. 
New codes can be obtained by annexing parity-check bits [168 + i, 69, 32], for 
1 <i x 3. With puncturing by one bit a [167, 69, 31] new code is obtained by 
shortening [168 — i, 69 — i, 32], for 1 < i < 5, 5 new codes are obtained with a 
minimum distance of 32. More improvements are also obtained by shortening these 
extended and punctured codes. Overall, with all of the new codes described and 
presented in this chapter, there are some 901 new binary linear codes which improve 
on Brouwer's lower bounds. The updated lower bounds are tabulated in Tables 5.5, 
5.6, 5.7, 5.8 and 5.9 in Appendix "Improved Lower Bounds of the Minimum Distance 
of Binary Linear Codes". 


5.7 Summary 


Methods have been described and presented which may be used to determine the 
minimum Hamming distance and weight distribution of a linear code. These are 
the main tools for testing new codes which are candidates for improvements to 
currently known, best codes. Several efficient algorithms for computing the minimum 
distance and weight distribution of linear codes have been explored in detail. The 
many different methods of constructing codes have been described, particularly those 
based on using known good or outstanding codes as a construction basis. Using such 
methods, several hundred new codes have been presented or described which are 
improvements to the public database of best, known codes. 

For cyclic codes, which have implementation advantages over other codes, many 
new outstanding codes have been presented including the determination of a table 
giving the code designs and highest attainable minimum distance of all binary cyclic 
codes of odd lengths from 129 to 189. It has been shown that outstanding cyclic 
codes may be used as code components to produce new codes that are better than 
the previously thought best codes, for the same code length and code rate. 
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Appendix 


Improved Lower Bounds of the Minimum Distance 
of Binary Linear Codes 


The following tables list the updated lower bounds of minimum distance of linear 
codes over Е;. These improvements—there аге 901 of them in total—are due to 
the new binary linear codes described above. In the tables, entries marked with C 
refer to cyclic codes, those marked with X, X X and УІ refer to codes obtained 
from Constructions X, XX and Y1, respectively. Similarly, entries marked with Е, 
P and S denote [n, k, d] codes obtained by extending (annexing an overall parity- 
check bit) to (n — 1, k, d") codes, puncturing (n + 1, k, d + 1) codes and shortening 
(n —- 1, k 4- 1, d) codes, respectively. Unmarked entries are the original lower bounds 
of Brouwer [6]. 
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Chapter 6 
Lagrange Codes 


6.1 Introduction 


Joseph Louis Lagrange was a famous eighteenth century Italian mathematician [1] 
credited with minimum degree polynomial interpolation amongst his many other 
achievements. Polynomial interpolation may be applied straightforwardly using 
Galois Fields and provides the basis for an extensive family of error-correcting codes. 
For a Galois Field СЕ (2"), the maximum code length is 2"*, consisting of 2" data 
symbols and 2" parity symbols. Many of the different types of codes originated by 
Goppa ІЗ, 4] may be linked to Lagrange codes. 


6.2 Lagrange Interpolation 


The interpolation polynomial, p(z), is constructed such that the value of the poly- 
nomial for each element of GF(2") is equal to a data symbol x; also from GF (2"). 
Thus, 


pO) = xo 
pa = x 
pa) = ж 
ре?) = x 
р(о2”-3) = х»—› 
pa”) = Xm 


Using the method of Lagrange, the interpolation polynomial is constructed as a 
summation of 2" polynomials, each of degree 2" — 1. Thus, 
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Table 6.1 GF(8) extension 


a —1 
field defined by 1 
l+a!+a3=0 woe 
a? = о? 
о = 1+0 
o^ = a + o? 
ow =1+at+a? 
af = 1+ 02 
т] 
р = УрО) (6.1) 
і-0 
where 
2 j=2"—2 — 
p = || 5— for iz0 (6.2) 
о a! — 0) 
j-0 zi 
and 
j22"—2 "T" o 
z) = х : 6.3 
роб) = xo П =) (6.3) 


The idea is that each of the p;(z) polynomials has a value of zero for 2 equal to 
each element of GF (2), except for the one element corresponding to i (namely o^! 
except for i = 0). 

A simpler form for the polynomials p;(z) is given by 


(a? — oF) z(z"-! — 1) 


'al(ai —l)  z—o 


piz) = х for 150 (6.4) 


апа 
po(z) = — (7! — 1) (6.5) 
In an example using GF (2°), where all the nonzero field elements may express as a 


power of a primitive root o of the primitive polynomial 1 + x + x°, modulo 1 + x’. 
The nonzero field elements are tabulated in Table 6.1. 
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All of the 8 polynomials р;(2) are given below 


ро = хоб" +1) 

p2-xG + +2 ovx +? ++ +2) 
pa) = xa(z! +az® +0225 +a3z4 +a4z3 +a5z* +z) 
p3(z) = x3(z’ +072 +a425 -po6z* paz? +032? +a5z) 
pa(z) = xa(z! Һо?с® +0% +0724 +0572? "pez? +atz) 
ps(z) = xs(z! +a4z® +az5 +a°z4 +0?z? +067? Бос) 
Pe(z) = xe(z! - 0526 co? +az4 +о° +a4z* Бо?) 
PIZ) = xy(z! -FaSz6 Fo? +a4z* +032? +072? +z) 


These polynomials are simply summed to produce the Lagrange interpolation poly- 
nomial p(z) 


рб) = “бо +x +a +% +x х5 -56 +27) 

+ “(ах +a2x. +03x3 +a4x4 +a°x5 +a%x6 +x7) 
+ 2 (a2x, talx +обхз Hax, +arx5 Бох +x7) 
+ z^(o?x, Haix +a x -„о?хд +axs Fa xg ех) 
+2 (atxi +ax. +0°x3 +a7x4 +a°x5 --o? xg +23) 
+ 2 (aP x] +a 3x. -Foxa +абха +atxs +a7x6 +x7) 
+ 2(оёху +a7x --a x3 J-o? x4 -Fa?xs +Һох +x7) 
+ X% 


(6.6) 


This can be easily verified by evaluating p(z) for each element of GR(2?) to produce 


p(0) = xo 
p) =x 
р(а) = 
р(о2) = x3 
pla?) = x4 
plat) = xs 
р(0) = x6 
р(о9) = Хт 


6.3 Lagrange Error-Correcting Codes 


The interpolation polynomial p(z) may be expressed in terms of its coefficients and 
used as a basis for defining error-correcting codes. 


m] 


ро = ud (6.7) 
1=0 
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It is clear that an interpolation equation and a parity check equation are equivalent, 
and for the 8 identities given by the interpolation polynomial we may define 8 parity 
check equations: 


Xo +р(0) -0 
xi - p(1) =0 
X2 + р(а) = 0 
хз + p(a^) = 0 
xi p(a?) = 0 un 
xs + p(a*) = 0 
x6 + р(о?) = 0 
x; + p(a®) = 0 


The 8 parity check equations become 


Xo+ Ho =0 
Xt pacto M+ Hac Hato nust poet HB; =0 
xj аш+ a pot о?из+ o^ gt ost ao uot ит = 


x3+ o? pi + аио+ абиз+ au4+ aust aust ил = 0 69 
x4+ аш абиә-- o? a4- oP mat aus+ atus+ u7 = (6.9) 
х5+ @°*н\+ oua4d- о?из+ œ u+ оби5-- œ? и6+ ит = 0 
х6+ а at «+ оз a at atus+ o^ ug-- u; = 0 


хт+ абш + oP pot afus+ oF ust aust aust u7 = 0 


A number of different codes may be derived from these equations. Using the first 
4 equations, apart from the first, and setting x2 and x3 equal to 0, the following parity 
check matrix is obtained, producing a (9, 5) code: 


Ho = 


Rearranging the order of the columns produces a parity check matrix, Н identical to 
the MDS (9, 5, 5) code based on the doubly extended Reed-Solomon code [7]. 


111111110 
^ la о? 0 аї о5 0% 00 
Hoss = lo? аїаб а о? о? 00 
1 оз обо?а5 а оа 01 


Correspondingly, we know that ће code with parity check matrix, Но,5 derived 
from the Lagrange interpolating polynomial is MDS and has a minimum Hamming 
distance of 5. Useful, longer codes can also be obtained. Adding the first row of (6.9) 
to the second equation of the above example and setting xo equal to хі, a parity check 
matrix for a (10, 6) code is obtained: 
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0101 1 1 1 1 11 
H _ 110 а o? o? a^ o? o6 1 
10.6 = 0000? at a® а о? 051 
001 о aha? о? a atl 


It is straightforward to map any code with GF (2/7) symbols into a binary code by 
simply mapping each GF (2") symbol into a m x m binary matrix using the GF (2") 
table of field elements. If the codeword coordinate is o, the coordinate is replaced 
with the matrix, where each column is the binary representation of the GF(2") 
symbol: 


[ о “її! git? 252 a | 


As an example for GF (2°), if the codeword coordinate is о? , the symbol is replaced 
with the binary matrix whose columns are the binary values of o?, а“, and o? using 
Table 6.1. 


101 
111 
011 


In another example the symbol «° produces the identity matrix 


100 
010 
001 


The (10, 6) GF(8) code above forms a (30, 18) binary code with parity check 
matrix 


000100000100100100100100100100 
000010000010010010010010010010 
000001000001001001001001001001 


100100000001010101011111110100 
010010000101011111110100001010 
001001000010101011111110100001 


Нзо 18 = 
000000000010011110001101111100 


000000000011110001101111100010 
000000000101111100010011110001 


000000100101110010111001011100 
000000010111001011100101110010 
000000001011100101110010110001 
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The minimum Hamming distance of this code has been evaluated and it turns out 
to be 4. Methods for evaluating the minimum Hamming distance are described in 
Chap. 5. Consequently, extending the length of the code by one symbol has reduced 
the dinin by 1. The dmin may be increased by 2 by adding an overall parity bit to the 
first two symbols plus an overall parity bit to all bits to produce a (32, 18, 6) code 
with parity check matrix 


00010000010010010010010010010000 
00001000001001001001001001001000 
00000100000100100100100100100100 
10010000000101010101111111010000 
01001000010101111111010000101000 
00100100001010101111111010000100 
11111100000000000000000000000010 
Hos = 
00000000001001111000110111110000 
00000000001111000110111110001000 
00000000010111110001001111000100 
00000010010111001011100101110000 
00000001011100101110010111001000 
00000000101110010111001011000100 
11111111111111111111111111111111 


This is a good code as weight spectrum analysis shows that it has the same 
minimum Hamming distance as the best known (32, 18, 6) code [5]. It is interesting 
to note that in extending the length of the code beyond the MDS length of 9 symbols 
for GF (23), two weak symbols are produced but these are counterbalanced by adding 
an overall parity bit to these two symbols. 


6.4 Error-Correcting Codes Derived from the Lagrange 
Coefficients 


In another approach, we may set some of the equations defining the Lagrange poly- 
nomial coefficients to zero, and then use these equations to define parity checks for 
the code. As an example, using GF (2?), from Eq. (6.6) we may set coefficients иу, 
H6, 145, Ма and из equal to zero. The parity check equations become 


Xo +x, +e. +з +м +45 +x +5 = 0 
OLX] Fax, +a3x3 -Fa*xa -Fa?xs +обх Tx; =0 
ox, Байх +a°x; “ох +a3x5 "Fo? xg +x7 =0 (6.10) 
ox] Боё» +a2x3 “Бож +ох5 -Fa^ xg Tx; =0 
a^x, +ax2 “оху +a?x4 +оёх; -Fa? xg Tx; =0 
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and the corresponding parity check matrix is 


11 1 1 1 1 11 
О a o? o? о” а? аб 1 
Hs = | 002 at аб а wa? 1 (6.11) 
Оо af o? а? а atl 
00 a o? а? аба? 1 


As a СЕ(23) code, this code is MDS with a dmin of 6 and equivalent to the extended 
Reed-Solomon code. As a binary code with the following parity check matrix a 
(24, 9, 8) code is obtained. This is a good code as it has the same minimum Hamming 
distance as the best known (24, 9, 8) code [5]. 


100100100100100100100100 
010010010010010010010010 
001001001001001001001001 


000001010101011111110100 
000101011111110100001010 
000010101011111110100001 


000010011110001101111100 
H9-|000011110001101111100010 
000101111100010011110001 


000101110010111001011100 
000111001011100101110010 
000011100101110010110001 


000011001111010110101100 
000110101100011001111010 
000111010110101100011001 


6.5 Goppa Codes 


So far codes have been constructed using the Lagrange interpolating polynomial 
in a rather ad hoc manner. Goppa defined a family of codes [3] in terms of 
the Lagrange interpolating polynomial, where the coordinates of each codeword 
(Со, C1, C2, ... C2» 1) with (co = xo, сү = X1, C2 = X2, . . . C2m—1 = Xo» 1) satisfy the 
congruence p(z) modulo g(z) — 0 where g(z) is known as the Goppa polynomial. 
Goppa codes have coefficients from GF (2") and provided g(z) has no roots which 
are elements of GF(2") (which is straightforward to achieve) the Goppa codes have 
parameters (2”, К, 2" — k + 1). These codes are MDS codes and satisfy the Singleton 
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bound [8]. Goppa codes as binary codes, provided that g(z) has no roots which are 
elements of GF(2") and has no repeated roots, have parameters (2", 2" — mt, dinin) 
where 4,, > 2t + 1, the Goppa code bound on minimum Hamming distance. Most 
binary Goppa codes have equality for the bound and f is the number of correctable 
errors for hard decision, bounded distance decoding. Primitive binary BCH codes 
have parameters (2" — 1, 2" — mt — 1, dmin), Where dmin > 2t+ 1 and so binary Goppa 
codes usually have the advantage over binary BCH codes of an additional information 
bitforthe same minimum Hamming distance. However, depending on the cyclotomic 
cosets, many cases of BCH codes can be found having either k > 2" — mt — 1 fora 
given f, or dmin > 2t + 1, giving BCH codes the advantage for these cases. 

For a Goppa polynomial of degree r, there are r parity check equations derived 
from the congruence p(z) modulo g(z) - 0. Denoting g(z) by 


ECZ) = в" + 8.1277 geoz +++ + iz + go (6.12) 
pe ol 
>) —— =0 modulo g(z) (6.13) 
Бр 


Since (6.13) is modulo g(z) then g(z) is equivalent to 0, and we сап add g(z) to the 
numerator. Noting that 


&(z) = (с — a) gi(z) + rm (6.14) 


where rm is the remainder, an element of GF(2”) after dividing g(z) by z — oj. 
Dividing each term z — о; into 1 + g(z) produces the following: 


у аа (6.15) 


2-04 2-- Qj 


As ғ, is а scalar, we may simply pre-weight g(z) by i so that the remainder 
cancels with the other numerator term which is 1. 


(z) Tm 
wt! aO, mtl aO 


2-- 04 Fm 2-- 04 Fm 


(6.16) 


As a result of 


g(z) = (z — o)qi(z) + ra 


when z = oj, гы = g(Qi) 
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Substituting for ғ, in (6.16) produces 


&(z) 


+1 А 
(о) = qi) (6.17) 
2-- Qi g(a) 
Since ECT modulo g(z) = 0 
1 j 
2 440) (6.18) 
2-0; g(a) 


The quotient polynomial g;(z) is a polynomial of degree r — 1, with coefficients 
which are a function of œ; and the Goppa polynomial coefficients. Denoting д; (с) as 


40) = dio  diiz diaz? + dia + diez | (6.19) 


Since the coefficients of each power of z sum to zero, the r parity check equations 
are given by 


У 21У =0 for j=0 to r-1 (6.20) 


If the Goppa polynomial has any roots which are elements of GF (2"), say о;, then the 
codeword coordinate c; has to be permanently set to zero in order to satisfy the parity 
check equations. Effectively, the code length is shortened by the number of roots 
of g(z) which are elements of GF(2"). Usually, the Goppa polynomial is chosen to 
have distinct roots which are not in GF(2”). 

Consider an example of a Goppa (32, 28, 5) code. There are 4 parity check sym- 
bols defined by the 4 parity check equations and the Goppa polynomial has degree 4. 
Choosing somewhat arbitrarily the polynomial 1 + z+ z* which has roots іп GF(16) 
but not in GF (32), we determine q;(z) by dividing by z — qj. 


qiz) = 2 кой +a7z+ (1 + 02) (6.21) 


The 4 parity check equations аге 


У. =0 (6.22) 


^ 8(о4) 
Сее 

—— =0 6.23 
5 g(a) ( ) 
У со? _ 0 (6.24) 
— о(о4) i f 
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| 3 
Y 2. —0 (6.25) 
ї=0 


Using Table 6.2 to evaluate the different terms for GF (25), the parity check matrix is 


1 1a a” a”... 010 


Ola a 028... о? 
H@2, 28,5) = od giai t.o (6.26) 
01017 a a ... а! 


To implement the Goppa code as a binary code, the symbols in the parity check 
matrix are replaced with their m-bit binary column representations of each respective 
GF (2") symbol. For the (32, 28, 5) Goppa code above, each of the 4 parity symbols 
will be represented as a 5 bit symbol from Table 6.2. The parity check matrix will 
now have 20 rows for the binary code. The minimum Hamming distance of the binary 
Goppa code is improved from r + 1 to 2r + 1, namely from 5 to 9. Correspondingly, 
the binary Goppa code becomes a (32, 12, 9) code with parity check matrix 


Table 6.2 GF (32) nonzero o9 —1 afc litatoa ro 
extension field elements 
defined by 1 + o? +о? = 0 a! =a ol! = 1 +а + о“ 
o? = о? 2018 = 1+а 
of Sa a= waa? 
оё ой 020 = a2 + а? 
a = 1+ 02 PORE асый 
af =a +a? o? = 1 фо? + о 
a! = o? + о o? = 1 фа +a? + о 
a8 = 1 +02 + о? o^ = о фа? + o? Бо“ 
o? = a + o? +о* o? = 1 фо? +at 
al = 1 +о* 026 = 1 фа +a? + о“ 
al!l = 1 +a +a? o?! = 1+а+о? 
g Peata аЗ 028 а +02 ot 
«ЇЗ = о2 фо o^ 029 = 1403 
al^ = 1 o? + o? +04 030 аа“ 
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11101... 
00000... 
00110... 
00111... 
00101... 
01110... 
00101... 
00111... 
00100... 
Нола = 01101. 
00110... 
00010... 
00110... 
00110... 
01110... 
00110... 
00010... 
00001... 
00110... 


(6.27) 


=. о њо о оны = CO ыы = = CO KH CK COC CO н 


6.6 BCH Codes as Goppa Codes 


Surprisingly, the family of Goppa codes includes as a subset the family of BCH codes 
with codeword coefficients from GF (2") and parameters (2" — 1, 2" —1—t,t+1). 
As binary codes, using codeword coefficients (0, 1), the BCH codes have parameters 
Q" — 1,2” — 1 — mt, 2t + 1). 

For a nonbinary BCH code to correspond to a Goppa code, the Goppa polynomial, 
g(z), is given by 


go =z (6.28) 
There are ¢ parity check equations relating to the codeword coordinates 
{Co, C1, C2, +++, €2» 2) and these are given by 
24-2 m 
>, —À =0 moduloz (6.29) 
z—a! 


i=0 
Dividing 1 by z — o/ starting with a! produces 


a (t Diet 


i = ee 
iD eau 
z—a! z — а! 


(6.30) 
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As a~“*iz! modulo z/ = 0, the t parity check equations are given by 


iss 
> co + az + a Fz? 4 TD... козі l)-Q (6.31) 
i=0 


Every coefficient of z? through to z’~! is equated to zero, producing t parity check 


equations. The corresponding parity check matrix is 


loa! а? а? ат... а70"-2 

loa? а a ат ... 0720"-2) 
Но") =| la 3 a6 a? aT’... aC" (6.32) 

laa? а a4... gt") 


To obtain the binary BCH code, as before, the GF(2") symbols are replaced with 
their m-bit binary column representations for each corresponding GF (2") value for 
each symbol. As a result, only half of the parity check equations are independent and 
the dependent equations may be deleted. To keep the same number of independent 
parity check equations as before, the degree of the Goppa polynomial is doubled. 
The Goppa polynomial is now given by 


g(z) =z” (6.33) 


The parity check matrix for ће binary Goppa ВСН code is 


1 a! a? a? о .. а70"-2) 

1 «^? a7 ағ» a? a q309"-2 

-5 -10 -15 -20 -5(2"-2 

Hi». 1,2» ы, 2t+1) = la a a а 292 а ( ) 
1 022-1 g-20:-D ұ-301-) ұ-4а-) | 7 Qr- 007-2) 


For binary codes, any parity check equation may be squared and the resulting 
parity check equation will still be satisfied. As a consequence, only one parity check 
equation is needed for each representative from each respective cyclotomic coset. 
This is clearer with an example. 

The cyclotomic cosets of 31, expressed as negative integers for convenience, are 
as follows 


Co — {0} 

Cı = {-1, —2, —4, —8, —16} 
Сіз =6, 12, 524. 517) 
С-5- {—5, —10, —20, —9, —18) 
C4 {—7,—14,—28, —25, 19] 
Ср = {—11, —22, —13, —26, —21} 
C. 45 = [—15, —30, —29, —27, —23} 


6.6 BCH Codes as Goppa Codes 149 


To construct the GF(32) nonbinary (31, 27) BCH code, the Goppa polynomial is 
g(z) = z^ and there are 4 parity check equations with parity check matrix: 


lata? а? ат... a 
H BE o a a... E 4 
(31,27,5) — | 1 y-3 -6 o? œ- !2 о-25 (6.34) 
lata 2712 0716... 072" 


As a binary code with binary codeword coefficients, the parity check matrix has only 
two independent rows. To construct the binary parity check matrix, each GF (32) 
symbolis replaced with its 5-bit column vector so that each parity symbol will require 
5 rows of the binary parity check matrix. The code becomes a (31, 21, 5) binary code. 
The parity check matrix for the binary code after removing the dependent rows is 
given by 


lat! an? a3 ат... a7? 
H14,21.5) = | ү 9-3 gS a q-2 0-2 (6.35) 


To maintain 4 independent parity check equations for the binary code, the Goppa 
polynomial is doubled in degree to become g(z) = z8. Replacing each GF (32) 
symbol with its 5-bit column vector will produce a (31, 11) binary code. The parity 
check matrix for the binary code is given by: 


lo! a? а? ат ...ат?0 
аЗ об о”? aT! ...а72% 

Ha, u, ,9) = 1 05 0—10 0—15 0—20... 26 (6.36) 
10-7 0-4 021 gy. V7 


Looking at the cyclotomic cosets for 31, it will be noticed that o^? is in ће same 
coset as о”, and for codewords with binary coefficients, we may use ће Goppa 
polynomial g(z) — 210 with the corresponding parity check matrix 


la^! a? а? а^ a a’ ... a7? 
a? о-6 a7? а-12 а-!5 а-!8 E 
H Е ша 6.37 
(31, 11, 11) la at a? gy y all... a (6.37) 
1 0-9 0-18 0-27 y y 749723. 022 


Alternatively, we may use Goppa polynomial g(z) = z? with parity check matrix 
given by (6.36). The result is the same code. From this analysis we can see why the 
dinin Of this BCH code is greater by 2 than the BCH code bound because the degree 
of the Goppa polynomial is 10. 


To find other exceptional BCH codes we need to look at the cyclotomic cosets to 
find similar cases where a row of the parity check matrix is equivalent to a higher 
degree row. Consider the construction of the (31, 6, 2t + 1) BCH code which will 
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have 5 parity check equations. From the cyclotomic cosets for 31, it will be noticed 
that a—!? is in the same coset as a~!!, and so we may use the Goppa polynomial 
g(z) = 214 and obtain a (31, 6, 15) binary BCH code. The BCH bound indicates a 
minimum Hamming distance of 11. Another example is evident from the cyclotomic 
cosets of 127 where o^!" is in the same coset as 07°. Setting the Goppa polynomial 
g(z) = 230 produces the (127, 71, 19) ВСН code, whilst ће ВСН bound indicates а 
minimum Hamming distance of 17. 


To see the details in the construction of the parity check matrix for the binary 
BCH code, we will consider the (31, 11, 11) code with parity check matrix given by 
matrix (6.37). Each GF(32) symbol is replaced with the binary representation given 
by Table 6.2, as a 5-bit column vector, where o is a primitive root of the polynomial 
14x32. 

The binary parity check matrix that is obtained is given by matrix (6.38). 


1010111... 
0101110... 
0001010... 
0010101... 
0101011... 


ооо н о 


1011010... 
0100110... 
0101101... 
0010011... 
0111011... 
Нап, = (6.38) 
1101100... 
0101111... 
0100100... 
0011010... 
0111000... 


оноо фо 


ооно н 


1100111... 
0000110... 
0110101... 
0010001... 
0111110... 


=.. O0. oD 


Evaluating the minimum Hamming distance of this code confirms that it is 11, an 
increase of 2 over the BCH bound for the minimum Hamming distance. 
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6.7 Extended BCH Codes as Goppa Codes 


In a short paper in 1971 [4], Goppa showed how a binary Goppa code could be 
constructed with parameters (2" + (m — 1)t, 2" — t, 2t + 1). Each parity check 
symbol, m bits long has a Forney concatenation [2], i.e. an overall parity bit on each 
symbol. In a completely novel approach by Goppa, each parity symbol, apart from 
1 bit in each symbol, is external to the code as if these are additional parity symbols. 
These symbols are also independent of each other extending the length of the code 
and, importantly, increasing the dmin of the code. Sugiyama et al. [9, 10] described а 
construction technique mixing the standard Goppa code construction with the Goppa 
external parity check construction. We give below a simpler construction method 
applicable to BCH codes and to more general Goppa codes. 

Consider a binary BCH code constructed as a Goppa code with Goppa polynomial 
(2) = z” but extended by including an additional root ао, an element of GF(2”). 
The Goppa polynomial is now g(z) = (z?'*! + оо22). The parity check equations 
are given by 


2-2 
У — =0 moduegG) a! 2 a (6.39) 


— о! 
і-0 5 


Substituting for ғ, and q(z), as іп Sect. 6.5 


modulo g(z) = sO + g(a’) (6.40) 


1 
cou g(a')(z — о!) 


For the extended binary BCH code with Goppa polynomial g(z) = (22! + œz”) 
the parity check equations are given by 


1-1 1-2 gc 3 


dn ci 2m. 3 72i 22 2 1 
=1 те — =з 1 Ci (=== 7a) +7 quit + xCD ku ТЕЛЕУ) Per ai 


(6.41) 
= 0 


Equating each coefficient of powers of 2 to zero and using only the independent 
parity check equations (as it is a binary code) produces ft + 1 independent parity 
check equations with parity check matrix 


ат! a? o? Ue oa 2"—2) 
aw a7 а s. q39"-2 
P q7!0 a S5 gy 52"—2) 
Hom—2,2--2-mt-m =| |, ОИТ (6.42) 
T+] 201—1) „—3@—) || y-Qr- 00" 72) 


-—2t —4t -бі -2(2т-2) 


а а о а 
a+ao а2--ао atao “`` a2" 2 +a 
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The last row may be simplified by noting that 


1+ aj"! a?! _ а! ag’ ag? a т! Й 
(ора) a anm gee а (9-55) 


Rearranging produces 


1 az” a о 1 оў 2 о 3 o; 2 
= e 6.44 
(ао + ада?! (оо + aja? + о?! 1 + «2 2 E о?! 3 + + a ( ) 
and 
—2t —2t 1 2 3 —2t41 
a _ % Og Qo Qo Qo 
(ata) (аа) йе!" ай? лз ыы 


The point here is because of the above equality, the last parity check equation in 
(6.42) may be replaced with a simpler equation to produce the same Cauchy style 
parity check given by Goppa in his 1971 paper [4]. The parity check matrix becomes 


ат! a? a? PUN a 0-2 
o? a а”? e. gq230-2 
a о-19 a5 ... gy 0-5 
Н 252, 292 п-т) = (6.46) 
gr 2+1 g-20:-1 g 32-1 _ -@—1)0”—2) 
1 1 1 1 
a+ao о2--ао obtag 777 a2" 2 Ego 


The justification for this is that from (6.45), the last row of (6.42) is equal to a scalar 
weighted linear combination of the rows of the parity check matrix(6.46), so that these 
rows will produce the same code as the parity check matrix (6.42). By induction, 
other roots of GF(2") may be used to produce similar parity check equations to 
increase the distance of the code producing parity check matrices of the form: 


a! o? ao о 2. a Q7» 
a 27% а”? a uu o 30"-2 
a5 a10 oa 15 a .. g-3$07-9 


rl 201 D зо! D 401 D gr Qr- 007-2) 


Hee (6.47) 
1 1 1 1 1 
a+ao а2--ао a? +оо atta ` a2" 2 Ego 
1 1 1 1 1 
о Бо о Ға o3-For ata, 777 o2" 2 Eg, 
1 1 1 1 
аар аар Hag- 0440-10 007 aT? esi 


The parity symbols given by the last sọ rows of this matrix are in the Cauchy matrix 
style [7] and will necessarily reduce the length of the code for each root of the 
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Goppa polynomial which is an element of GF(2"). However, Goppa was the first 
to show [4] that the parity symbols may be optionally placed external to the code, 
without decreasing the length of the code. For binary codes the length of the code 
increases as will be shown below. Accordingly, with external parity symbols, the 
parity check matrix becomes 


ат! o? o? a^ 2. а70"-2) 0000 

o? o а”? ао 2, q9?- 0000 

o? q 10 o P «9%... 5-9 0000 

на 2141 0201-0) 301—1) 401-1) -01-00"-2) 0 0 0 0 
1 1 1 1 1 

atao a pan «+оо epe dui o?" 2 ор 1000 

vum Jaa, TERT gu е ue 01 00 
1 1 1 1 1 

аат аар ojos s: 0440-10 777 a?" beri 0001 

(6.48) 


As an example of the procedure, consider the (31, 11, 11) binary ВСН code described 
in Sect. 6.6. We shall add one external parity symbol to this code according to the 
parity check matrix in (6.48) and eventually produce a (36, 10, 13) binary BCH code. 
Arbitrarily, we shall choose a = 1. This means that the first column of the parity 
check matrix for the (31, 11, 11) code given in (6.38) is deleted and there is one 
additional parity check row. The parity check matrix for this (35, 10, 12) extended 
BCH code is given below. Note we will add later an additional parity bit in a Forney 
concatenation of the external parity symbol to produce the (36, 10, 13) code as a last 
step. 


[04 1 [94 [94 [04 a a . a 
a 3 a 6 a 9 a 12 a 15 a 18 а 28 0 
5 
Hs, 10. 12) = a a 10 a 15 a 20 a 25 a 30 а 26 0 (6.49) 
a 9 а 18 a 27 a 5 a 14 a 23 a 22 0 
1 1 1 1 1 1 
atl о2+1 o?41 о*+1 о?+1 оба ^^^ «?-+1 


Evaluating the last row Бу carrying out the additions, and inversions, referring to the 
table of GF (32) symbols in Table 6.2 produces the resulting parity check matrix 


a! о? oa? a^ о? g 9 ... 07200 
a? a5 а а 12 а 15 0-18... 0 90 
Hs, 10.12) = | « 5 0710 0-15 4720 ұ-5 4730. 0726 0 (6.50) 
a? о 198977 о 5 y 023... 0—22 0 
ag P о 26 y y g-79 at ... a4 1 


The next step is to determine the binary parity check matrix for the code by replacing 
each GF (32) symbol by its corresponding 5-bit representation using Table 6.2, but as 
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а 5-bit column vector. Also we will add an additional parity check row to implement 
the Forney concatenation of the external parity symbol. The resulting binary parity 
check matrix in (6.51) is obtained. Evaluating the minimum Hamming distance of 
this code using one of the methods described in Chap.5 verifies that it is indeed 13. 

Adding the external parity symbol has increased the minimum Hamming distance 
by 2, but at the cost of one data symbol. Instead of choosing a = 1, a good idea 
is to choose оу = 0, since 0 is a multiple root of the Goppa polynomial g(z) = 219 
which caused the BCH code to be shortened from length 2" to 2" — 1 in the first 
place. (The length of a Goppa code with Goppa polynomial g(z) having no roots in 
GF (2") is 2"). The resulting parity check matrix is given in (6.52). 


010111...0000000 
101110...1000000 
001010...0000000 
010101...0000000 
101011...0000000 


011010...0000000 
100110...0000000 
101101...0000000 
010011...1000000 
111011...0000000 


101100...1000000 
101111...0000000 

РА |.|100100...1000000 
66.10.13 =| 011010...0000000 
111000...0000000 


(6.51) 


100111...0000000 
000110...1000000 
110101...0000000 
010001...1000000 
111110...1000000 


111101...1100000 
100001...1010000 
010010...0001000 
001001...0000100 
000100...1000010 
000000...0111111 
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107! a? qa? а aq? a... a~ 
1073 о6 a? а? ат а! ... о 
Нз, 1) = 1075 0710 al а 720 а 725 430 gy 
lata Ba T е a... w 
loa! а? а? at ar а®...а 
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(6.52) 


The problem with this is that the minimum Hamming distance is still 11 because 
the last row of the parity check matrix is the same as the first row, apart from the 
external parity symbol because 0 is a root of the Goppa polynomial. The solution 
is to increase the degree of the Goppa polynomial but still retain the external parity 
symbol. Referring to the cyclotomic cosets of 31, see (6.35), we should use g(z) — 212 


to produce the parity check matrix 


loa! a? a? aq aq? аб ...a7?0 
loa? aî a? a) g5g-8...980 
Нз, 11) = Іоза бао-Зоа- 00-50-90, 0726 0 (6.53) 
1 0° 0-18 0—27 a at 4-73... a 22 0 
10-1 an y -l an о... 0-21 


As before, the next step is to determine the binary parity check matrix for the code 
from this matrix by replacing each GF(32) symbol by its corresponding 5 bit rep- 
resentation using Table 6.2 as a 5 bit column vector. Also we will add an additional 
parity check row to implement the Forney concatenation of the external parity sym- 
bol. The resulting binary parity check matrix is obtained 


1010111... 
0101110... 
0001010... 
0010101... 
0101011... 


1011010... 
0100110... 
0101101... 
0010011... 
0111011... 


1101100... 
0101111... 
0100100... 
0011010... 
0111000... 


0000000 
1000000 
0000000 
0000000 
0000000 


0000000 
0000000 
0000000 
1000000 
0000000 


1000000 
0000000 
1000000 
0000000 
0000000 
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1100111...0000000 
0000110...1000000 
0110101...0000000 
0010001...1000000 
0111110...1000000 

Ноти =| 1001101...1100000 (554) 
0010101...1010000 
0100010...1001000 
0111001...0000100 
0010010...0000010 
0000000...0111111 


Weight spectrum analysis of this code confirms that the dmin is indeed 13. One or 
more Cauchy style parity check equations may be added to this code to increase the 
dmin Of the code. For example, with one more parity check equation again with the 
choice of оо = 1, the parity check matrix for the (42,10) code is 


а І а a a a а * а 
a? a? aoa 12 а 15 x 18. a 300 
H = Q^? 20710 0715 0720 0725 æ... y-2600 (6.55) 
(42, 10) a 9 a 18 y 27 a 5 а 14a 23 а 2200 ý 
a П 0722 y-2 gy-13 0724 a~t. 072010 
a 18 о? 2729 y 10 q-2 gy—27 a 701 


Replacing each СР (32) symbol by its corresponding 5 bit representation using 
Table 6.2 as a 5-bit column vector and adding an additional parity check row to 
each external parity symbol produces the binary parity check matrix for the (42, 10, 
15) code. 


010111...0000000000000 
101110...1000000000000 
001010...0000000000000 
010101...0000000000000 
101011...0000000000000 


..0000000000000 
..0000000000000 
..0000000000000 


.1000000000000 


..0000000000000 


.1000000000000 


..0000000000000 


.1000000000000 


..0000000000000 
..0000000000000 
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100111...0000000000000 
000110...1000000000000 
110101...0000000000000 
010001...1000000000000 
111110...1000000000000 


001101...1100000000000 
010101...1010000000000 
100010...1001000000000 

Haz 1015) =| 111001...0000100000000 (6.56) 
010010...0000010000000 
000000...0111111000000 


010010...1000000100000 
010000...0000000010000 
111000...1000000001000 
100110...1000000000100 
110101...1000000000010 
000000...0000000111111 


Weight spectrum analysis of this code confirms that the d,nin is indeed 15. In this con- 
struction the information bit coordinate corresponding to a = 1 is deleted, reducing 
the dimension of the code by 1. This is conventional practice when the Goppa poly- 
nomial g(z) contains a root that is in GF(2"). However, on reflection, this is not 
essential. Certainly, in the parity check symbol equations of the constructed code, 
there will be one parity check equation where the coordinate is missing, but additional 
parity check equations may be used to compensate for the missing coordinate(s). 

Consider the (42, 10) code above, given by parity check matrix (6.55) without 
the deletion of the first coordinate. The parity check matrix for the (42, 11) code 
becomes 


loa! a? a3 а a a ...a 900 
la? об а? a` a- a! y 800 
1 05 а -10 0—15 о 20 и 25 w- о -26 00 
На = 1 y o 18 w27 a5 olt AMNEM (6.57) 
loa! 72 a? a-l a^ a4 ... a 210 
00718 о> 0729 0710 0-2 0-7 a 01 


It will be noticed that the first coordinate is not in the last parity check equation. 
Constructing the binary code as before by replacing each GF (32) symbol by its cor- 
responding 5-bit representation using Table 6.2 as a 5-bit column vector and adding 
an additional parity check row to each external parity symbol produces a (42, 11, 
13) binary code. There 15 no improvement in the dmin of the (42, 11, 13) binary 
code compared to the (37, 11, 13) binary code despite the 5 additional parity bits. 
However, weight spectrum analysis of the (42, 11, 13) binary code shows that there 
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is only 1 codeword of weight 13 and only 3 codewords of weight 14. АП of these 
low weight codewords contain the first coordinate which is not surprising. Two more 
parity check equations containing the first coordinate need to be added to the parity 
check matrix to compensate for the coordinate not being in the last equation of the 
parity check symbol matrix (6.57). 

It turns out that the coordinate in question can always be inserted into the overall 
parity check equation to each external parity symbol without any loss, so that only one 
additional parity check equation is required for each root of g(z) that is in GF (2"). 

This produces the following binary parity check matrix for the (43, 11, 15) code. 


1010111...00000000000000 
0101110...10000000000000 
0001010...00000000000000 
0010101...00000000000000 
0101011...00000000000000 
1011010...00000000000000 
0100110...00000000000000 
0101101...00000000000000 
0010011...10000000000000 
0111011...00000000000000 
1101100...10000000000000 
0101111...00000000000000 
0100100...10000000000000 
0011010...00000000000000 

Has 1.15 =| 0111000...00000000000000 (6.58) 
1100111...00000000000000 
0000110...10000000000000 
0110101...00000000000000 
0010001...10000000000000 
0111110...10000000000000 
1001101...11000000000000 
0010101...10100000000000 
0100010...10010000000000 
0111001...00001000000000 
0010010...00000100000000 
0000000...01111110000000 
0010010...10000001000000 


0010000... 


00000000100000 
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0111000...10000000010000 
0100110...10000000001000 
0110101...10000000000100 
1000000...00000001111110 
1000000...00000000000001 


It will be noticed that the last but one row is the Forney concatenation on the last 
GF (32) symbol of parity check matrix (6.57), the overall parity check on parity bits 
36-41. Bit O has been added to this equation. Also, the last row of the binary parity 
check matrix is simply a repeat of bit 0. In this way, bit 0 has been fully compensated 
for not being in the last row of parity check symbol matrix (6.57). 

BCH codes extended in length in this way can be very competitive compared to 
the best known codes [5]. The most efficient extensions of BCH codes are for g(z) 
having only multiple roots of z — 0 because no additional deletions of information 
bits are necessary nor are compensating parity check equations necessary. However, 
n does need to be a Mersenne prime, and the maximum extension is 2 symbols with 
2m + 2 additional, overall parity bits, increasing the 4,, by 4. Where n is not a 
Mersenne prime the maximum extension is 1 symbol with m 4- 1 additional, overall 
parity bits, increasing the dmin by 2. 

However regardless of n being a Mersenne prime or not, multiple symbol exten- 
sions may be carried out if g(z) has additional roots from GF (2"), increasing the 
ап by 2 for each additional root. The additional root can also be z = 0. 

As further examples, a (37, 11, 13) code and a (43, 11, 15) code can be constructed 
in this way by extending the (31, 11, 11) BCH code. Also a (135, 92, 13) code and 
a (143, 92, 15) code can be constructed by extending the (127, 92, 11) BCH code. 
A (135, 71, 21) code and a (143, 71, 23) code can be constructed by extending the 
(127, 71, 19) BCH code. 

For more than 2 extended symbols for Mersenne primes, or more than 1 extended 
symbol for non-Mersenne primes, it is necessary to use mixed roots of g(z) from 
GF (2") and have either deletions of information bits or compensating parity check 
equations or both. As examples of these code constructions there are: 


An example of a non Mersenne prime, the (76, 50, 9) code constructed from the 
BCH (63, 51, 5) code with additional roots of g(z) at z = Oand o deleting the 
first information bit. 

The (153, 71, 25) code extended from the (127, 71, 19) code with additional roots 
of g(z) at = 0, o? anda! with 2 additional, compensating parity check bits. 
The (151, 70, 25) code extended from the (127, 71, 19) code with additional roots 
of g(z) atz = 0, o? anda! with the first coordinate deleted reducing the dimension 
by 1 and one additional, compensating parity check bit. 

The (160, 70, 27) code extended from the (127, 71, 19) code with additional roots 
of g(z) at z = 0, о0, а! ando? with the first coordinate deleted reducing the 
dimension by 1 and with 2 additional, compensating parity check bits. 

The (158, 69, 27) code extended from the (127, 71, 19) code with additional roots 
of g(z) at z = 0, a9, a! , a? ando? with the first 2 coordinates deleted reducing 
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the dimension by 2 and one additional, compensating parity check bit. АП of these 
codes are best known codes [5]. 


6.8 Binary Codes from MDS Codes 


The Goppa codes and BCH codes, which are a subset of Goppa codes, when con- 
structed as codes with symbols from GF (q) are all MDS codes and are examples of 
generalised Reed-Solomon codes [7]. MDS codes are exceptional codes and there 
are not many construction methods for these codes. For (n, К) MDS codes the гере- 
tition code, having Ё = 1, can have any length of п independently of the field size 4. 
For values k = 3 and k = q— 1 and with q even the maximum value of n is n = q+2 
[7]. For all other cases, the maximum value of п is n = q + 1 with a construction 
known as the doubly extended Reed-Solomon codes. The parity check matrix for a 
(q + 1, k) doubly extended Reed-Solomon code is 


1 1 1 1 1 1 ] ... 1 10 
lo; о оз 04 05 (6 а4-2 0 0 
1 a? az a2 o2 az a2 НЕЕ 2 0 0 
Hrs, =| 1 о) oj oj oj о af E 0 0 (6.59) 
1 at as оз ой ag ad 04-2 0 0 
1 a0 * af а oT 047% gd 6; 01 
where the д elements of GF (q) are (0, 1, о, 02, @3,..., 05 1). 


As the codes are MDS, the minimum Hamming distance is q + 2 — К, forming a 
family of (q + 1, k, q + 2 — К) codes meeting the Singleton bound [8]. 

The MDS codes may be used as binary codes simply by restricting the data 
symbols to values of (0 and 1) to produce a subfield subcode. Alternatively for 
GF (2") each symbol may be replaced with a m x m binary matrix to produce the 
family of ((2" + 1)m, mk, 2" + 2 — К) of binary codes. As an example, with m = 4 
апа К = 12, the result is a (68, 48, 5) binary code. This is not a very competitive code 
because the equivalent best known code [5], the (68, 48, 8) code, has much better 
minimum Hamming distance. 

However, using the Forney concatenation [2] on each symbol almost doubles 
the minimum Hamming distance with little increase in redundancy and produces 
the family of ((2" + 1) (m + 1), mk, 2(2" + 1 — k) + 1) of binary codes. With 
the same example values for т and К the (85, 48, 11) binary code is produced. 
Kasahara [6] noticed that it is sometimes possible with this code construction to add 
an additional information bit by adding the all 175 codeword to the generator matrix of 
the code. Equivalently expressed, all of the codewords may be complemented without 
degrading the minimum Hamming distance. It is possible to go further depending 
on the length of the code and the minimum Hamming distance. Since the binary 
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parity of each symbol is always even, then if m + 1 is an odd number, then adding 
the all 175 pattern to each symbol will produce weight of at least 1 per symbol. For 
the (85, 48, 11) constructed binary code m + 1 = 5, an odd number and the number 
of symbols is 17. Hence, adding the all 1’s pattern (i.e. 85 175) to each codeword 
will produce a minimum weight of at least 17. Accordingly, a (85, 49, 11) code is 
produced. Adding an overall parity bit to each codeword increases the minimum 
Hamming distance to 12 producing a (86, 49, 12) code and shortening the code 
by deleting one information bit produces a (85, 48, 12) code. This is a good code 
because the corresponding best known code is also a (85, 48, 12) code. However, 
the construction method is different because the best known code is derived from the 
(89, 56, 11) cyclic code. 

Looking at constructing binary codes from MDS codes by simply restricting the 
data symbols to values of (0 and 1), consider the example of the extended Reed- 
Solomon code of length 16 using GF(2^) with 2 parity symbols. The code is the 
MDS (16, 14, 3) code. The parity check matrix is 
iuto!) uuu ab wg! a alal alat Vg 


6,9 3 6 2,9 3 6 9 2 (6.60) 


lo? аёо? a? 1 o? a6 o? al? 1 о? a a а 


H614 = | 


With binary codeword coordinates, denoted as c; the first parity check equation from 
the first row of the parity check matrix is 


14 
S сю! =0 (6.61) 


Squaring both sides of this equation produces 
14 
> co? = 0 (6.62) 
i-0 


As the codeword coordinates are binary, e = с; апа so any codeword satisfying the 
equations of (6.58) satisfies all of the following equations by induction from (6.60) 


lal uuu uu qiu uw go gu ө? Vit iig 
la? dt af at alabat M ш? ал ELT) 

Has6,14) = e P бі. yn е 2 we e e a a е Y 2 : 
: la^ оаа о? о? а?а ааа? a а а O 
10% a? оз a? 1 af a"? o? а? 1 o9 а? а а? 1 


(6.63) 


There аге 4 consecutive zeros of ће parent Reed-Solomon code from the first 4 rows 
of the parity check matrix indicating that the minimum Hamming distance may be 5 
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Table 6.3 СЕ(16) extension 
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00 —1 
field defined by 1 
l+a'+a*=0 т 
a^ = а 
uem 
o^ =1+а 
оз-а--о2 
a6 = a? + o? 
o! =1+о + o? 
a5 = 1+ o? 
o? = a + o? 
al = 1 +a +a? 
all =a +e? +a 
al? =1+a +a? + o? 
а13 = 1 ро? +03 
ait — 1 +03 


for the binary code. However, comparing е last column of this matrix with (6.57) 
indicates that this column is not correct. 

Constructing the binary check matrix from the parity check equations, (6.58) 
using Table6.3 substituting the respective 4 bit vector for each column vector of 
each nonzero GF(16) symbol, (0 in GF(16) is 0000) produces the following binary 
check matrix 


1000100110101110 
0100110100101000 
0010011010111100 
0001001101011110 
Has,s) = (6.64) 
1000110001100011 
0001100011000110 
0010100101001010 
0111101111011110 


Weight spectrum analysis indicates the minimum Hamming distance of this code 
is 4 due to a single codeword of weight 4,{0, 5, 10, 15}. Deleting the last column of 
the parity check matrix produces a (15, 8, 5) code. Another approach is needed to 
go from the MDS code to a binary code without incurring a loss in the minimum 
Hamming distance. 

It is necessary to use the generalised Reed-Solomon MDS code. Here, each col- 
umn of the parity check matrix is multiplied by a nonzero element of the GF(2") 
field defined as (uo, ш, 02, M3, ..., Lom}. It is not necessary for these to be dis- 
tinct, just to have a multiplicative inverse. The parity check matrix for the (q + 1, k) 
generalised Reed-Solomon MDS code is 
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V9 Vy V5 V3 v4 Vs s Vg-2 14-1 0 
Vo 101 1202 1303 0404 0505 ... Уд-204-2 0 0 
Vo vio? naz уз02 D vsa? «+› Va 0 0 
Hers+ = | Vo vio] од V30/3 мо} ШУН 20; , 0 0 
Vo vio] о V3or уой уа v2 94220222 0 0 
vo уа! i wal E уҙа g vai à Vso' AR Ve-201 5 0 v, 


It is clear that as a nonbinary code with codeword coefficients from GF(2"), the 
distance properties will remain unchanged as the generalised Reed-Solomon is still 
an MDS code. Depending on the coordinate position each nonzero element value 
has a unique mapping to another nonzero element value. It is as subfield subcodes 
that the generalised Reed-Solomon codes have an advantage. It should be noted that 
Goppa codes are examples of a generalised Reed-Solomon code. 

Returning to the relatively poor (16, 8, 4) binary code derived from the (16, 14, 3) 
MDS code, consider the generalised (16, 14, 3) Reed-Solomon code with parity 
check matrix. 


vo VI V2 з V4 Vs V6 ШЕ уа 0115 


н _ oc 
чем) vo vig! vg? узо? оцой vsa? vga? ... visa? уда!“ 0 


| (6.65) 


Setting the vector v to 


iu at. o), a’, o^, al, о, о, о, о, al, o, o, o, a’, "iL 


Constructing the binary check matrix from these parity check equations using 
Table 6.3 by substituting the respective 4 bit vector for each column vector of each 
nonzero GF (16) symbol, (0 in GF(16) is 0000) produces the following binary check 
matrix 


1100101000000101 
1101110000100011 
1000001101011101 
1011000111000011 
Has,s,5) = (6.66) 
1001101101011010 
1111000010100000 
1111110110110110 
1001011110111100 


Weight spectrum analysis indicates that the minimum Hamming distance of this code 
is 5 and achieves the aim of deriving a binary code from an MDS code without loss of 
minimum Hamming distance. Moreover, the additional symbol of 1, the last column 
in (6.59), may be appended to produce the following check matrix for the (17, 9, 5) 
binary code: 
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11001010000001010 
11011100001000110 
10000011010111010 
10110001110000110 
Нат,%5) = (6.67) 
10011011010110101 
11110000101000000 
11111101101101100 
10010111101111000 


Not surprisingly, this code has the same parameters as the best known code [5]. Тһе 
reader will be asking, how is the vector v chosen? 

Using trial and error methods, it is extremely difficult, and somewhat tiresome to 
find a suitable vector v, even for such a short code. Also weight spectrum analysis 
has to be carried out for each trial code. 

The answer is that the vector v is constructed from an irreducible Goppa poly- 
nomial of degree 2 with g(z) = o? + z + 22. Referring to Table 6.3, the reader may 
verify using all elements of GF(16), that v is given by g(a;)~! for i = 0% 15. 

Unfortunately the technique is only valid for binary codes with minimum Ham- 
ming distance of 5 and also m has to be even. Weight spectrum analysis has confirmed 
that the (65, 53, 5), (257, 241, 5), (1025, 1005, 5) and (4097, 4073, 5) codes can be 
constructed in this way from doubly extended, generalised Reed-Solomon, MDS 
codes. 


6.9 Summary 


It has been shown that interpolation plays an important, mostly hidden role in alge- 
braic coding theory. The Reed-Solomon codes, BCH codes, and Goppa codes are all 
codes that may be constructed via interpolation. It has also been demonstrated that all 
of these codes form part of a large family of generalised MDS codes. The encoding of 
BCH and Goppa codes has been explored from the viewpoint of classical Lagrange 
interpolation. It was shown in detail how Goppa codes are designed and constructed 
starting from first principles. The parity check matrix of a BCH code was derived as 
a Goppa code proving that BCH codes are a subset of Goppa codes. Following from 
this result and using properties of the cyclotomic cosets it was explained how the 
minimum Hamming distance of some BCH codes is able to exceed the BCH bound 
producing outstanding codes. It was shown how these exceptional BCH codes can 
be identified and constructed. A little known paper by Goppa was discussed and as 
a result it was shown how Goppa codes and BCH codes may be extended in length 
with additional parity check bits resulting in increased minimum Hamming distance 
of the code. Several examples were given of the technique which results in some 
outstanding codes. Reed-Solomon codes were explored as a means of constructing 
binary codes resulting in improvements to the database of best known codes. 
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Chapter 7 
Reed-Solomon Codes апа Binary 
Transmission 


7.1 Introduction 


Reed-Solomon codes named after Reed and Solomon [9] following their publication 
in 1960 have been used together with hard decision decoding in a wide range of 
applications. Reed-Solomon codes are maximum distance separable (MDS) codes 
and have the highest possible minimum Hamming distance. The codes have symbols 
from F, with parameters (4 - 1, К, q — К). They are not binary codes but frequently 
are used with 4 — 2", and so there is a mapping of residue classes of a primitive 
polynomial with binary coefficients [6] and each element of Fy» is represented as а 
binary m-tuple. Thus, binary codes with code parameters (m[2" —1], km, 2" —k) can 
be constructed from Reed-Solomon codes. Reed-Solomon codes can be extended 
in length by up to two symbols and in special cases extended in length by up to 
three symbols. In terms of applications, they are probably the most popular family 
of codes. 

Researchers over the years have tried to come up with an efficient soft decision 
decoding algorithm and a breakthrough in hard decision decoding in 1997 by Madhu 
Sudan [10], enabled more than Z errors to be corrected with polynomial time com- 
plexity. The algorithm was limited to low rate Reed-Solomon codes. An improved 
algorithm for all code rates was discovered by Gursuswami and Sudan [3] and led 
to the Guruswami and Sudan algorithm being applied in a soft decision decoder by 
Kötter and Vardy [5]. A very readable, tutorial style explanation of the Guruswami 
and Sudan algorithm is presented by McEliece [7]. Many papers followed, dis- 
cussing soft decision decoding of Reed-Solomon codes [1] mostly featuring sim- 
ulation results of short codes such as the (15, 11, 5) and the (31, 25, 7) code. 
Binary transmission using baseband bipolar signalling or binary phase shift keying 
(BPSK) [8] and the additive white gaussian noise (AWGN) channel is most com- 
mon. Some authors have used quadrature amplitude modulation (QAM) [8] with 2” 
levels to map to each Fyn symbol [5]. In either case, there is a poor match between 
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the modulation method and the error-correcting code. The performance achieved is 
not competitive compared to other error-correcting code arrangements. For binary 
transmission, a binary error-correcting code should be used and not a symbol-based 
error-correcting code. For QAM and other multilevel signalling, better performance 
is obtained by applying low-rate codes to the least significant bits of received sym- 
bols and high-rate codes to the most significant bits of received symbols. Applying 
a fixed-rate error-correcting code to all symbol bits is the reason for the inefficiency 
in using Reed-Solomon codes on binary channels. 

Still, these modulation methods do provide a means of comparing different 
decoder arrangements for RS codes. This theme is explored later in Sect. 7.3 where 
soft decision decoding of RS codes is explored. 


7.22 Reed-Solomon Codes Used with Binary 
Transmission-Hard Decisions 


Whilst RS codes are very efficient codes, being MDS codes, they are not particularly 
well suited to the binary channel as it will become apparent from the results presented 
below. Defining the RS code over Fy, RS codes extended with a single symbol 
are considered with length n = 2”, with k information symbols, and with dmin = 
n—k+ 1. The length in bits, np = mn and there аге k, information bits with Къ = km. 

The probability of a symbol error with binary transmission and the AWGN channel 


15 
-1-|1- T, mE 7.1 
Ps 2 rfc No ( 1) 


n—k4l 
2 


The RS code can correct t errors where t = | | Accordingly, a decoder error 


occurs if there are more than t symbol errors and the probability of decoder error, 
pc is given by 


n 


! | j 
pe = Уос pid = py (7.2) 


— i)li! 
eri (n — i)ti! 


As a practical example, we will consider the (256, 234, 23) extended RS code. 
Representing each Ёз symbol as a binary 8 tuple the RS code becomes a (2048, 
1872, 23) binary code. The performance with hard decisions is shown in Fig. 7.1 as 
a function of xb This code may be directly compared to the binary (2048, 1872, 
33) Goppa code since their lengths and code rates are identical. The decoder error 
probability for the binary Goppa code is given by 
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Fig. 7.1 Comparison of hard decision decoding of the (256, 234, 23) RS code compared to the 
(2048, 1872, 33) Goppa code (same code length in bits and code rate) 


nm (nm)! 1 k E, i 1 k E, nm—i 
= 1 7.3 
dis 2: (nm — Get n =) ( 2776; =) ve 


i=tgtl 


where tg = | | for the binary Goppa code. 

The comparison in performance is shown in Fig. 7.1 and it can be seen that the 
Goppa code is approximately 0.75dB better than the RS code at 1 x 10719 frame 
error rate. 

It is interesting to speculate whether the performance of the RS code could be 
improved by using 3-level quantisation of the channel bits and erasing symbols if 
any of the bits within a symbol are erased. The probabilities of a bit erasure Derase 
and bit error p; for 3-level quantisation are given in Chap. 3, Eqs. (3.41) and (3.42) 
respectively, but note that a lower threshold needs to be used for best performance 
with these code parameters, J/ E, —0.2 x c instead of V E, —0.65 хо. The probability 
of a symbol erasure, ps erase 18 given by 


PS erase = 1- (1 = Реғазе)" (7.4) 


and the probability of a symbol error, ps error is given by 


PS error = 1— (1-  — po") - (1 — рь)" (7.5) 
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Fig. 7.2 Comparison of hard decision and erasure decoding of the (256, 250, 7) RS code for the 
binary channel 


and 


PS error = (1— Perase)” -(1- рь)" (7.6) 
For each received vector, provided the number of errors ¢ and the number of erasures 
s such that 2t + s < n — k, then the received vector will be decoded correctly. А 
decoder error occurs if 2t + s > n — К. 

The probability distribution of errors and erasures in the received vector, e(z) may 
be easily found by defining a polynomial p(z) and raising it to the power of n, the 
number of symbols in a codeword. 

e(z) == (1 — PS error — PS erase + Ps iud же + Ps — n d (7.7) 
The probability of decoder error pc is simply found from e(z) by summing all 
coefficients of 277 where i is greater than n — k. This is very straightforward with a 
symbolic mathematics program such as Mathematica. The results for the RS (256, 
234, 23) code are shown in Fig. 7.1. It can be seen that there is an improvement over 
the hard decision case but it is rather marginal. 

A rather more convincing case is shown in Fig. 7.2 for the RS (256, 250, 7) code 
where the performance is shown down to frame error rates of 1 x 10720. In this case, 
there is an improvement of approximately 0.4 dB. 
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It has already been established that for the binary transmission channel, the RS 
codes based on G F(2"), do not perform as well as a binary designed code with 
the same code parameters. The problem is that bit errors occur independently and 
it only takes a single bit error to cause a symbol error. Thus, the code structure, 
being symbol based, is not well matched to the transmission channel. Another way 
of looking at this is to consider the Hamming distance. For the binary (2048, 1872) 
codes considered previously, the RS-based code turns out to have a binary Hamming 
distance of 23 whilst the binary Goppa code has a Hamming distance of 33. However, 
there is a simple method of modifying RS codes to produce good binary codes as 
discussed in Chap. 6. It is a code concatenation method best suited for producing 
symbol-based binary codes whereby a single overall binary parity check is added to 
each binary m-tuple representing each symbol. Starting with a RS (n, k,n — k — 1) 
code, adding the overall binary parity checks produces a (n[m + 1], km, 2[n —k — 1]) 
binary code. Now the minimum weight of each symbol is 2, producing a binary code 
with twice the minimum Hamming distance of the original RS code. Kasahara [4] 
realised that in some cases an additional information bit may be added by adding the 
all 1’s codeword to the generator matrix. Some best known codes are constructed in 
this way as discussed in Chap. 6. One example is the (161, 81, 23) binary code [6]. 


7.3 Reed-Solomon Codes and Binary Transmission Using 
Soft Decisions 


RS codes applied to the binary transmission channel will now be considered using 
unquantised soft decision decoding. The best decoder to use is the modified Dorsch 
decoder, discussed in Chap. 15, because it provides near maximum likelihood decod- 
ing. However when used with codes having a significant coding gain, the code length 
needs to be typically less than 200 bits. 


We will consider augmented, extended RS codes constructed from G F (2). The 
length is 2” + 1 and these are Maximum Distance Separable (MDS) codes with 
parameters (2" + 1, k, 2"*! — К). Moreover, the general case is that augmented, 
extended RS codes may be constructed using any Galois Field G F (q) with parame- 
ters (4+1, К, g+2—k) [6]. Denoting the д field elements as 0, a, 01, 06, ... 04-2. 
the parity-check matrix is given by 


j j j 
a pA Ks а 1 0 
i+ j+ j+ i+ 
о) : an : о» | 02-2 0 0 
j+ j+ j+ j+ 
H о) ол о» 02-2 0 0 
j+q—k—1 | j4q—k-1l | j+q—k-1 {+4—К—1 
ой d о o a wars 0 0 
j+q-k j+q-k j--q—k jta—k 
0 02-2 0 1 
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Table 7.1 СЕ(32) non-zero o —1 al6 = 1 фато 4 a 
extension field elements 1 T 4 
defined by 1 +02 + о? = 0 pom" eas pad. 
a^ = а a°=Il+a 
o? = a? al? = о +a? 
at = ай a — a? уЗ 
ag zd dg? a2! 304 
E а2--1-а2 4 
a? = a? + о o? = 1 +а 2 ро? 
a5 = 1 +02 +a? o^ = о фа? + о + о“ 
o? = о +a? +оё o? = 1 +а? + о“ 
al = 1 +о* 026 = 1 фа +о2 + о“ 
all =14a4+a? o?! = 1+а+о? 
ol? = о -+ «2+ о? 028 = о фо? Ьо“ 
al = a? +a? +ой 029 = 1+ o? 
al^ = 1 o? 4 o? +04 a =a gd 
a = 1 +a +a? +a? +at 


There are q — k + 1 rows of the matrix corresponding to the q — k + 1 parity 
symbols of the code. Any of the q — k + 1 columns form a Vandermonde matrix 
and the matrix is non-singular which means that any set of q — k + 1 symbols of 
a codeword may be erased and solved using the parity-check equations. Thus, the 
code is MDS. The columns of the parity-check matrix may be permuted into any 
order and any set of s symbols of a codeword may be defined as parity symbols and 
permanently erased. Thus, their respective columns of H may be deleted to form a 
shortened (2" + 1 — s, К, 2"*! — s — k) MDS code. This is an important property 
of MDS codes, particularly for their practical realisation in the form of augmented, 
extended RS codes because it enables efficient implementation in applications such 
as incremental redundancy systems, discussed in Chap. 17, and network coding. 
Using the first q — 1 columns of Н, and setting ag, 01, 05,... а> equal to 
o9, al, о2,... o4, where o is a primitive element of G F (q) a cyclic code may 
be constructed, which has advantages for encoding and decoding implementation. 

We will consider the shortened RS code (30, 15, 16) constructed from the G F (2?) 
extension field with H constructed using j = 0 and o being the primitive root of 
1 + x? + x?. The GF (32) extension field table is given in Table 7.1 based on the 
primitive polynomial 1 + x? + x? so that 1 + o? + o? = 0, modulo 1 + x?!. 

The first step in the construction of the binary code is to construct the parity-check 
matrix for the shortened RS code (30, 15, 16) which is 
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] 1 1221 
1 а o? ...9? 
1 a? её 27 
Heoi = | 1 o? o^ и 
ВЕЗЕ р 
1 ata... æ 


Each element of this parity-check matrix is to be replaced with a 5 x 5 matrix in terms 
of the base field, which in this case is binary. First, the number of rows are expanded 
to form H@o,7s) given by matrix (7.8). The next step is to expand the columns in 
terms of the base field by substituting for powers of o using Table 7.1. For example, 
if an element of the parity-check matrix Н (зо,75) is, say о26 then this is replaced by 
1 +æ +g? + o^ which in binary is 11101. Proceeding in this way the binary matrix 
Н (150,75) is produced (some entries have been left as they were to show the procedure 
partly completed) as in matrix (7.9). 


1 1 1 1 
aaa a 
a o? о? ... o? 
оз оз o? ... о? 
об at at... at 
1 a o? ...9? 
o o? o? ... o? 
o? a o^. 1 
оз ой o? ... a 
a^ о? ab... o? 
1 o? o* ... a?! 
o оз а? ... a” 
oa? оќ аб... а? 
Hoz = | 23 05 al a (7.8) 
o^ аб aè. 1 
1 o? об... a” 
o at o! ...o?? 
o? о? а... a” 
оз об o? ... 97? 
at al all... a2 
PF x 
агы: ый 
ат ай 4%. ul 
оза ] ... a 
ata a ... o? 
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10000 10000 10000 ... 10000 
01000 01000 01000... 01000 
00100 00100 00100... 00100 
00010 00010 00010... 00010 
00001 00001 00001... 00001 
10000 01000 00100 ... 10010 
01000 00100 00010... a” 

00100 00010 00001 ... 10000 
00010 00001 10100 ... 01000 
00001 10100 01010 ... 00100 
10000 00100 00001 ... 11010 
01000 00010 10100... 01101 
00100 00001 01010... 10010 
00010 10100 00101... o?? 

00001 01010 10110... 10000 
10000 00010 01010... 10011 
01000 00001 00101... 11101 
00100 10100 10110... 11010 
00010 01010 01011 ... 01101 
00001 00101 œ! ...11010 


Н (150,75) = (7.9) 


10000 а 01101... 00010 
01000 a5 10010... 00001 
00100 о6 о%9.. 10100 
00010 о! 1 ...01010 
00001 08 а ... 00101 


The resulting binary code is a (150, 75, 16) code with the dmin ће same as the 
symbol-based RS (30, 15, 16) code. As observed by MacWilliams [6], changing the 
basis can increase the d,,;, of the resulting binary code, and making j = 3 in the RS 
parity-check matrix above produces a (150, 75, 19) binary code. 

А (150, 75, 22) binary code with increased dmin can be constructed using the 
overall binary parity-check concatenation as discussed above. Starting with the (25, 
15, 11) RS code, an overall parity check is added to each symbol, producing a parity- 
check matrix, Н(150,75,22) given by matrix (7.10). We have constructed two binary 
(150, 75) codes from RS codes. It is interesting to compare these codes to the known 
best code of length 150 and rate 1. The known, best codes are to be found іп a 
database [2] and the best (150, 75) code has a dmin of 23 and is derived by shortening 
by one bit (by deleting the x!” coordinate from the G matrix) of the (151, 76, 23) 
cyclic code whose generator polynomial is 


100001 100001 100001 ... 100001 
010001 010001 010001 ... 010001 
001001 001001 001001... 001001 
000101 000101 000101 ... 000101 
000011 000011 000011 ... 000011 
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100001 010001 001001 ... 100100 
010001 001001 000101 ... 010010 
001001 000101 000011 ... 100001 
000101 000011 101000 ... 010001 
000011 101000 010100... 001001 
100001 001001 000011 ... 110101 
010001 000101 101000 ... O11011 
001001 000011 010100 ... 100100 
000101 101000 001010 ... 010010 
000011 010100 101101 ... 100001 
H59,7522, = | 100001 000101 010100... 100111 (7.10) 
010001 000011 001010 ... 111010 
001001 101000 101101 ... 110101 
000101 010100 010111 ... O11011 
000011 001010 100010... 110101 
100001 101110 011011 ... 000101 
010001 111111 100100 ... 000011 
001001 110110 010010 ... 101000 
000101 110011 1 ... 010100 
000011 110000 010001 ... 001010 


3 


g(x) = 1+х7 txt xo tx Ha РР Ha Fx" + 
x2? x? 28 x30 x3! x34 36 x? x? x40 x? | 46 
48 x50 x52 x59 х60 "E xe х70 x73 х74 x? (71 1) 


These three binary codes, the RS-based (150, 75, 19) and (150, 75, 22) codes together 
with the (150, 75, 23) shortened cyclic code have been simulated using binary trans- 
mission for the AWGN channel. The decoder used is a modified Dorsch decoder 
set to evaluate 2 x 107 codewords per received vector. This is a large number of 
codewords and is sufficient to ensure that quasi-maximum likelihood performance is 
obtained. In this way, the true performance of each code is revealed rather than any 
shortcomings of the decoder. 

The results are shown in Fig. 7.3. Also shown in Fig. 7.3, for comparison purposes, 
is the sphere packing bound and the erasure-based binomial bound discussed in 
Chap. 1. Interestingly, all three codes have very good performance and are very close 
to the erasure-based binomial bound. Although not close to the sphere packing bound, 
this bound is for non-binary codes and there is an asymptotic loss of 0.187 dB for 
rate 1 binary codes іп comparison to the sphere packing bound as the code length 
extends towards oo. 

Comparing the three codes, no code has the best overall performance over the 
entire range of ҖЕ, and, surprisingly Ше d,,;,, of the code is no guide. The reason for 
this can be seen from the Hamming distances of the codewords decoded in error for 
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binary (150,75,19) from (30,15,16) RS code + 
Forney (150,75,22) from (25,15,11) RS code 
Cyclic (150,75,23) code ж 
erasure bound for (150,75) code п 4 
sphere packing bound for (150,75) ш 


FER 


Eb/No [dB] 


Fig. 7.3 Comparison of the (150, 75, 19) code derived from the RS(30, 15, 16) code, the concate- 
nated (150, 75, 22) code and the known, best (150, 75, 23) code derived by shortening the (151, 76, 
23) cyclic code 


the three codes after 100 decoder error events. The results are shown in Table 7.2 at 
M — 3 dB. From Table 7.2 it can be seen that the concatenated code (150, 75, 22) has 
more error events with Hamming distances in the range 22-32, but the (150, 75, 23) 
known, best code has more error events for Hamming distances up to 36 compared 
to the (150, 75, 19) RS derived code, and this is the best code at 22 = = 3 dB. 

The distribution of error events is illustrated by the Simulate distribution of 
error events plotted in Fig. 7.4 as a function of Hamming distance. The weakness of 
the (150, 75, 22) code at M — 3 dB is apparent. 


At higher values of Еһ Na? ihe higher dmin of the (150, 75, 23) known, best code 
causes it to have the best nds as can be seen from Fig. 7.3. 


7.4 Summary 


This chapter studied further the Reed-Solomon codes which are ideal symbol-based 
codes because they are Maximum Distance Separable (MDS) codes. These codes 
are not binary codes but were considered for use as binary codes in this chapter. The 
performance of Reed-Solomon codes when used on a binary channel was explored 
and compared to codes which are designed for binary transmission. The construction 
of the parity-check matrices of RS codes for use as binary codes was described 
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ТаЫе 7.2 Hamming distances and multiplicities of 100 error events for each of the (150, 75) codes 


at <2 —3 dB 
Hamming (150, 75, 19) Code (150, 75, 22) Code (150, 75, 23) Code 
distance number number number 
22 0 4 0 
24 0 4 0 
25 1 0 0 
26 1 9 0 
27 3 0 7 
28 5 7 6 
29 4 0 0 
30 8 22 0 
31 7 0 15 
32 7 19 20 
33 14 0 0 
34 8 14 0 
35 5 0 19 
36 8 13 18 
37 3 0 0 
38 8 5 0 
39 7 0 9 
40 6 1 2 
41 2 0 0 
42 1 2 0 
43 1 0 1 
44 1 0 1 
47 0 0 1 
48 0 0 1 


in detail for specific code examples. The performance results of three differently 
constructed (150, 75) codes simulated for the binary AWGN channel, using a near 
maximum likelihood decoder, were presented. Surprisingly the best performing code 
at 1074 error rate is not the best, known (150, 75, 23) code. Error event analysis was 
presented which showed that this was due to the higher multiplicities of weight 
32-36 codeword errors. However, beyond 10-6 error rates the best, known (150, 75, 
23) code was shown to be the best performing code. 
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7.4 Cumulative distribution of Hamming distance error events for the (150, 75, 19) code 


derived from the RS(30, 15, 16) code, the RS binary parity-check concatenated (150, 75, 22) code 
and the known, best (150, 75, 23) code derived by shortening the (151, 76, 23) cyclic code 
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Chapter 8 
Algebraic Geometry Codes 


8.1 Introduction 


In order to meet channel capacity, as Shannon postulated, long error-correction codes 
with large minimum distances need to be found. A large effort in research has been 
dedicated to finding algebraic codes with good properties and efficient decoding 
algorithms. Reed-Solomon (RS) codes are a product of this research and have over 
the years found numerous applications, the most noteworthy being their implemen- 
tation in satellite systems, compact discs, hard drives and modern, digitally based 
communications. These codes are defined with non-binary alphabets and have the 
maximum achievable minimum distance for codes of their lengths. A generalisation 
of RS codes was introduced by Goppa using a unique construction of codes from 
algebraic curves. This development led to active research in that area so that cur- 
rently the complexity of encoding and decoding these codes has been reduced greatly 
from when they were first presented. These codes are algebraic geometry (AG) codes 
and have much greater lengths than RS codes with the same alphabets. Furthermore 
these codes can be improved if curves with desirable properties can be found. AG 
codes have good properties and some families of these codes have been shown to be 
asymptotically superior as they exceed the well-known Gilbert- Varshamov bound 
[16] when the defining finite field IF; has size 4 > 49 with 4 always a square. 


8.2 Motivation for Studying AG Codes 


Aside from their proven superior asymptotic performance when the field size 42 > 
49, AG codes defined in much smaller fields have very good parameters. A closer 
look at tables of best-known codes in [8, 15] shows that algebraic geometry codes 
feature as the best-known linear codes for an appreciable range of code lengths for 
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different field sizes q. To demonstrate a comparison the parameters of AG codes 
with shortened BCH codes in fields with small sizes and characteristic 2 is given. 
AG codes of length n, dimension k have minimum distance d = n — k — g + 1 where 
g is called the genus . Notice that n — k + 1 is the distance of a maximum distance 
(MDS) separable code. The genus g is then the Singleton defect s of an AG code. 
The Singleton defect is simply the difference between the distance of a code and the 
distance some hypothetical MDS code of the same length and dimension. Similarly 
a BCH code is a code with length n, dimension К, and distance d =n — k — s + 1 
where s is the Singleton defect and number of non-consecutive roots of the BCH 
code. 

Consider Table 8.1, which compares the parameters of AG codes from three curves 
with genera 3, 7, and 14 with shortened BCH codes with similar code rates. At high 
rates, BCH codes tend to have better minimum distances or smaller Singleton defects. 
This is because the roots of the BCH code with high rates are usually cyclically 
consecutive and thus contribute to the minimum distance. For rates close to half, AG 
codes are better than BCH codes since the number of non-consecutive roots of the 
BCH code is increased as a result of conjugacy classes. The AG codes benefit from the 
fact that their Singleton defect or genus remains fixed for all rates. As a consequence 
AG codes significantly outperform BCH codes at lower rates. However, the genera 
of curves with many points in small finite fields are usually large and as the length 
of the AG codes increases іп Fg, the BCH codes beat AG codes in performance. 
Tables 8.2 and 8.3 show the comparison between AG and BCH codes in fields F16 
and F32, respectively. With larger field sizes, curves with many points and small 
genera can be used, and AG codes do much better than BCH codes. It is worth noting 
that Tables 8.1, 8.2 and 8.3 show codes in fields with size less than 49. 


8.2.1 Bounds Relevant to Algebraic Geometry Codes 


Bounds on the performance of codes that are relevant to AG codes are presented in 
order to show the performance of these codes. Let A, (и, d) represent the number of 
codewords in the code space of a code % with length n, minimum distance d and 
defined over a field of size 4. Let the information rate be R = k/n and the relative 
minimum distance be 6 = d/n for 0 < à < 1, then 


1 
o, (5) = lim —Ag (n, бл) 


which represents the k/n such that there exists a code over a field of size 4 that has 
d/n converging to ó [18]. The 4-агу entropy function is given by 


H, (x) 0, х= 0 
Б) ——1 
T xlog,(q — 1) — x log} x — (1 — x) log, (1 — x), 0<х<0 
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Table 8.1 Comparison between BCH and AG codes in Fg 
Rate AG code in Ёз | Number of Genus | Shortened BCH | BCH code in 
points code in F 3 IF5s 
0.2500 [23, 5, 16] 24 3 [23, 5, 12] [63, 45, 12] 
0.3333 [23, 7, 14] 24 3 [23, 7, 11] [63, 47, 11] 
0.5000 [23, 11, 10] 24 3 [23, 10, 8] [63, 50, 8] 
0.6667 [23, 15, 6] 24 3 [23, 14, 6] [63, 54, 6] 
0.7500 [23, 17, 4] 24 3 [23, 16, 5] [63, 56, 5] 
0.8500 [23, 19, 2] 24 3 [23, 18, 4] [63, 58, 4] 
0.2500 [33, 8, 19] 34 7 [33, 7, 16] [63, 37, 16] 
0.3333 [33, 11, 16] 34 7 [33, 11, 14] [63, 41, 14] 
0.5000 [33, 16, 11] 34 7 [33, 15, 12] [63, 45, 12] 
0.6667 [33, 22, 5] 34 7 [33, 22, 7] [63, 52, 7] 
0.7500 [33, 24, 3] 34 7 [33, 24, 6] [63, 54, 6] 
0.2500 [64, 16, 35] 65 14 [64, 16, 37] [63, 15, 37] 
0.3333 [64, 21, 30] 65 14 [64, 20, 31] [63, 19, 31] 
0.5000 [64, 32, 19] 65 14 [64, 31, 22] [63, 30, 22] 
0.6667 [64, 42, 9] 65 14 [64, 42, 14] [63, 41, 14] 
0.7500 [64, 48, 3] 65 14 [64, 48, 11] [63, 47, 11] 
Table 8.2 Comparison between BCH and AG codes in F16 
Rate AG code in Ёз | Number of Genus) Shortened BCH | BCH code in 
points code іп F4 Ел 
0.2500 [23, 5, 18] 24 1 [23, 4, 11] [255, 236, 11] 
0.3333 [23, 7, 16] 24 1 (23, 6, 10] [255, 238, 10] 
0.5000 [23, 11, 12] 24 1 (23, 10, 8] (255, 242, 8] 
0.6667 (23, 15, 8] 24 1 (23, 14, 6] (255, 246, 6] 
0.7500 [23, 17, 6] 24 1 (23, 16, 5] (255, 248, 5] 
0.8500 (23, 19, 4] 24 1 (23, 18, 4] (255, 250, 4] 
0.2500 [64, 16, 43] 65 6 [64, 16, 27] [255, 207, 27] 
0.3333 [64, 21, 38] 65 6 [64, 20, 25] [255, 211, 25] 
0.5000 (64, 32, 27] 65 6 [64, 32, 19] [255, 223, 19] 
0.6667 [64, 42, 17] 65 6 [64, 41, 13] [255, 232, 13] 
0.7500 [64, 48, 11] 65 6 [64, 47, 10] [255, 238, 10] 
0.8500 [64, 54, 5] 65 6 [64, 53, 7] [255, 244, 7] 
0.2500 [126, 31, 76] 127 20 [126, 30, 57] [255, 159, 57] 
0.3333 [126, 42, 65] 127 20 [126, 41, 48] [255, 170, 48] 
0.5000 [126, 63, 44] 127 20 [126, 63, 37] [255, 192, 37] 
0.6667 [126, 84, 23] 127 20 [126, 84, 24] [255, 213, 24] 
0.7500 [126, 94, 13] 127 20 [126, 94, 19] [255, 223, 19] 
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Table 8.3 Comparison between BCH and AG codes in F32 


Rate АС code in Ез | Number of Genus Shortened BCH | BCH code in ЕЁ 
points code іп F54 
0.2500 | [43, 10, 33] 44 1 ГАЗ, 10, 18] [1023, 990, 18] 
0.3333 | [43, 14, 29] 44 1 (АЗ, 14, 16] (1023, 994, 16] 
0.5000 | [43, 21, 22] 44 1 (АЗ, 20, 13] (1023, 1000, 13] 
0.6667 | [43, 28, 15] 44 1 [43, 28, 9] (1023, 1008, 9] 
0.7500 |[43, 32, 11] 44 1 (А3, 32, 7] [1023, 1012, 7] 
0.8500 | [43, 36, 7] 44 1 (А3, 36, 5] [1023, 1016, 5] 
0.2500 |[75, 18, 53] 76 5 [75, 18, 30] [1023, 966, 30] 
0.3333 | [75, 25, 46] 76 3 [75, 24, 27] [1023, 972, 27] 
0.5000 |[75, 37, 34] 76 5 [75, 36, 21] [1023, 984, 21] 
0.6667 | [75, 50, 21] 76 5 (75, 50, 14] (1023, 998, 14] 
0.7500 | [75, 56, 15] 76 5 [75, 56, 11] [1023, 1004, 11] 
0.8500 |[75, 63, 8] 76 5 [75, 62, 8] [1023, 1010, 8] 
0.2500 |[103, 25, 70] 104 9 [103, 25, 42] [1023, 945, 42] 
0.3333 | [103, 34, 61] 104 9 [103, 33, 38] [1023, 953, 38] 
0.5000 |[103, 51, 44] 104 9 [103, 50, 28] [1023, 970, 28] 
0.6667 |[103, 68, 27] 104 9 [103, 68, 19] [1023, 988, 19] 
0.7500 |[103, 77, 18] 104 9 [103, 76, 15] [1023, 996, 15] 
0.8500 |[103, 87, 8] 104 9 [103, 86, 10] [1023, 1006, 10] 


The asymptotic Gilbert- Varshamov lower bound on o, (б) is given by, 
a,(6)>1—H,(6) for0x8 x0 


The Tsfasman- Vladut-Zink bound is a lower bound on о, (5) and holds true for 
certain families of AG codes, it is given by 


(д0) 21—8— where ,/4 е М/0 


1 
/4-1 
The supremacy of AG codes lies іп the fact that the TVZ bound ensures that these 
codes have better performance when 4 is a perfect square and 4 > 49. 

The Figs. 8.1, 8.2 and 8.3 show the R vs 6 plot of these bounds for some range 
of q. 
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Gilbert-Varshamov SS 
Tsfasman-Vladut-Zink —*— 


alpha,(n,d) 


Fig. 8.3 Tsfasman-Vladut-Zink and Gilbert- Varshamov bound for 4 = 256 


8.3 Curves and Planes 


In this section, the notion of curves and planes are introduced. Definitions and discus- 
sions are restricted to two-dimensional planes and all polynomials are assumed to be 
defined with coefficients in the finite field F,. The section draws from the following 
sources |2, 12, 17, 18]. Let f(x, у) be a polynomial in the bivariate ring F,[x, y]. 


Definition 8.1 (Curve) A curve is the set of points for which the polynomial f (x, y) 
vanishes to zero. Mathematically, a curve 2 is associated with a polynomial f (x, y) 
so that f(P) = {0|Р є 22. 


A curve is a subset of a plane. There are two main types of planes; the affine plane 
and the projective plane. These planes are multidimensional, however, we restrict 
our discussion to two-dimensional planes only. 


Definition 8.2 (Affine Plane) A two-dimensional affine plane denoted by A? (Еу) is 
a set of points, 


А(Е,) = (о, В): a, B € Fy} (8.1) 
which has cardinality q?. 
A curve & is called an affine curve if 2 с А? (Fy). 


Definition 8.3 (Projective Plane) A two-dimensional projective plane IP? (Е, ) is the 
algebraic closure of А2 and is defined as the set of equivalence points, 
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P*(F,) = (0: 8: D: a, Be Ej) | J(o: 1:0: œ € Fy} [ Jta:0:0). 


A curve 27 is said to lie in the projective plane if 2° C IP?(IF,). The points in the 
projective plane are called equivalence points since for any point Р є Р? (Fy), 


if f (хо, уо, zo) = 0, Шеп f(axo,ayo,az0) =0 « € F7, P = (хо: yo : zo) 


because f(x, y, 2) is homogeneous. The colons in the notation of a projective point 
(x : y : z) represents this equivalence property. 

The affine polynomial f (x, y) is in two variables, in order to define a projective 
polynomial in three variables, homogenisation is used, 


Lug БӘРІ = 
f(x,y,z) = fF is d = Degree of f(x, y) 


which turns f(x, у) into a homogeneous! polynomial in three variables. An 


n-dimensional projective polynomial has n + 1 variables. The affine space А2 (Fy) 
is a subset of P?(F,) and is given by, 


A’(F,) = {(@: 8:1): a, ВєЕ,) с PE). 
A projective curve can then be defined as a set of points, 


Ж ={P: f(P)=0, PeP’@,)}. 


Definition 8.4 (Point at Infinity) A point on a projective curve 2 that coincides 
with any of the points of P?(F,) of the form, 


(о:1:0): де F,)U((0:0:0) 


i.e. points (xo : yo : zo) for which zo = 015 called a point at infinity. 


A third plane, called the bicyclic plane [1], is a subset of the A? (Ед) and consists 
of points, 


(о, B) : a, B € F; \ (05. 
This plane was defined so as to adapt the Fourier transform to AG codes since the 
inverse Fourier transform is undefined for zero coordinates. 


Example 8.1 Consider the two-dimensional affine plane A? (F4). Following the def- 
inition of A?(F4) we have, 


! Bach term in the polynomial has degree equal to d. 
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(0,0) (0,17 (10) (1,1) 
(1,0) (0,1) (1,02) (a, 1) 
(02, o) (a, o?) (0,0?) (0,0) 
(02,0) (0, 0) (о2,о2) (а, o) 


where о is the primitive element of the finite field F4. The two-dimensional projective 
plane IP? (F4) is given by, 


Affine Points Points at Infinity 
(0:0: 1) (0: 1: 1) (1: 0: 1) (1: 1: D) (0: 1: 0) (1: 0: 0) 
(1: a: 1) (o: 1: 1) (1: 02: 1) (02: 1: 1) (a: 1: 0) 
(02: a: 1) (a: a2: 1) (0: 02: 1) (0: a: 1) (02: 1: 0) 


(02:0: 1) (a: 0: 1) (02: о2:1) (a: a: 1) (1: 1: 0) 


Definition 8.5 (Irreducible Curve) A curve associated with a polynomial f (x, у, z) 
that cannot be reduced or factorised is called irreducible. 


Definition 8.6 (Singular Point) A point on a curve is singular if its evaluation on all 
partial derivatives of the defining polynomial with respect to each indeterminate is 
Zero. 


Suppose fx, fy, and f. denote partial derivatives of f(x, у, 2) with respect to x, 
y, and z respectively. A point P € 2% is singular if, 


Ә.О, Әу), ӘЙ _ 
ax = Ses ду n az = fi 


АСР) = fy(P) = Х(Р)-0. 


Definition 8.7 (Smooth Curve) A curve X is nonsingular or smooth does not con- 
tain any singular points. 


To obtain AG codes, it is required that the defining curve is both irreducible and 
smooth. 


Definition 8.8 (Genus) The genus of a curve can be seen as a measure of how many 
bends a curve has on its plane. The genus of a smooth curve defined by f(x, y, z) is 
given by the Pliicker formula, 


—1)(4—2 
= p d — Degree of f (x, y, z) 


The genus plays an important role in determining the quality of AG codes. It is 
desirable for curves that define AG codes to have small genera. 
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Example 8.2 Consider the Hermitian curve in F4 defined as, 


foy = х? -y-y affine 


f(x,y,z) = х? + y)z yz)? projective via homogenisation 


Itis straightforward to verify that the curve is irreducible. The curve has the following 
projective points, 


(0:0:1) (0:1:1) (g:m:D (w:o: 
(02:0: 1) (02:02: D) (10:0:D (0:02: (0:1:0) 


Notice the curve has a single point at infinity Р, = (0 : 1 : 0). Опе сап easily check 
that the curve has no singular points and is thus smooth. 


8.3.1 Important Theorems and Concepts 


The length of an AG code is utmost the number of points on the defining curve. Since 
it is desirable to obtain codes that are as long as possible, it is desirable to know what 
the maximum number of points attainable from a curve, given a genus is. 


Theorem 8.1 (Hasse-Weil with Serre's Improvement [2]) The Hasse—Weil theorem 
with Serre's improvement says that the number of rational points? of an irreducible 
curve, n, with genus g in F, is upper bounded by, 


п<4+1+ 812/4]. 


Curves that meet this bound are called maximal curves. The Hermitian curves 
are examples of maximal curves. Bezout's theorem is an important theorem, and is 
used to determine the minimum distance of algebraic geometry codes. It describes 
the size of the set which is the intersection of two curves in the projective plane. 


Theorem 8.2 (Bezout’s Theorem [2]) Any two curves Xa and Z, with degrees of 
their associated polynomials as m and n respectively, have utmost m x n common 
roots in the projective plane counted with multiplicity. 


Definition 8.9 (Divisor) A divisor on a curve 2 is a formal sum associated with 
the points of the curve. 


D= >, nyP 


PEX 


where 7 , are integers. 


2А rational point is a point of degree one. See Sect. 8.4 for the definition of the degree of point on 
a curve. 
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A zero divisor is one that has n, = 0 for all P € 2. A divisor is called effective 
if it is not a zero divisor. The support of a divisor is a subset of 2° for which n, Æ 0. 
The degree of a divisor is given as, 


deg(D) = У n, deg(P) 
PEX 


For simplicity, it is assumed that the degree of points Р € 2%, і.е. deg(P) is 1 
(points of higher degree are discussed in Sect. 8.4). Addition of two divisors Dı = 
Š peg прР and D; = > peg NpP is so defined, 


Dı + D2 = >, (ny +np)P. 
PEX 


Divisors are simply book-keeping structures that store information on points of a 
curve. Below is an example the intersection divisor of two curves. 


Example 8.3 Consider the Hermitian curve in Ёл defined as, 
Лб, y z) =x yzy 
with points given in Example 8.2 and the curve defined by 
f(x,y,z) = х 
with points 
(0:0: D (0:1:D 0:a:1) 0: a2: 1) (0:1:0) 
These two curves intersect at 3 points below all with multiplicity 1, 
(0:0:1) (0:1:0) (0:1: 1). 
Alternatively, this may be represented using a divisor D, 
D=(0:0:1)+(0:1:0)+ (0:1: 1) 


with n, the multiplicity, equal to 1 for all the points. Notice that the two curves meet 
at exactly deg( fi)deg( f?) = 3 points in agreement with Bezout's theorem. 


For rational functions with denominators, points in divisor with п, < 0 are poles. 
For example, D = Р, — 2Р will denote an intersection divisor of two curves that 
have one zero P, and pole P» with multiplicity two in common. Below is the formal 
definition of the field of fractions of a curve X. 


Definition 8.10 (Field of fractions) The field of fractions F,(.2°) of a curve 2 
defined by a polynomial f (x, y, 2) contains all rational functions of the form 
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g(x, у, 2) 
h(x, у, 2) 


with the restriction that g(x, у, z) and (х, у, z) are homogeneous polynomials that 
have the same degree and are not divisible by f(x, y, z). 


A subset (Riemann-Roch space) of the field of fractions of 2 meeting certain 
conditions are evaluated at points of the curve 2 to form codewords of an AG code. 
Thus, there is a one-to-one mapping between rational functions in this subset and 
codewords of an AG code. The Riemann- Roch theorem defines this subset and gives 
a lower bound on the dimension of AG codes. The definition of a Riemann-Roch 
space is given. 

Definition 8.11 (Riemann—-Roch Space) Тһе Riemann-Roch space associated with 
a divisor D is given by, 


L(D) = {t eF,CZ)|(t) + D = 0} UN 


where FF, (.27) is the field of fractions and (7) is the intersection divisor? of the rational 
function ¢ and the curve 2. 


Essentially, the Riemann-Roch space associated with a divisor D is a set of 
functions of the form t from the field of fractions IF, (.2^) such that the divisor sum 
(t) + D has no poles, i.e. (t) + D > 0. 

The rational functions in L(D) are functions from the field of fractions Е, (27) 
that must have poles only in the zeros (positive terms) contained in the divisor D, 
each pole occurring with utmost the multiplicity defined in the divisor D and most 
have zeros only in the poles (negative terms) contained in the divisor D, each zero 
occurring with at least the multiplicity defined in the divisor D. 


Example 8.4 Suppose a hypothetical curve 2 has points of degree one, 
X = (P, Po, Рз, Pa} 


We choose a divisor D = 2P; — 5P, with degree —3, and define a Riemann-Roch 
space L(D). If we randomly select three functions ту, t2, and із from the field of 
fractions IF, (.27) such that they have divisors, 


(tj) = —3P --5Р,--4Р, (t5) = 2P, +4Р (t5) = –Р + 8Р + Рз. 


tı ¢ L(D) since (1) + D = —P| + 4P, contains negative terms or poles. Also, 
t; € L(D) since (5) + D = АР! — P; contains negative terms. However, t3 е L(D) 
since (t3) + D = P, --3P5 + Рз contains no negative terms. Any function t € Е,(.27) 
is also in L(D) if it has a pole at P, with multiplicity at most 2 (with no other poles 
in common with 2°) and a zero at P» with multiplicity at least 5. 


З Ап intersection divisor is a divisor that contains information on the points of intersection of two 
curves. 
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The Riemann-Roch space is a vector space (with rational functions as elements) 
thus, a set of basis functions. The size of this set is the dimension of the space. 


Theorem 8.3 (Riemann Roch Theorem [2]) Let X be a curve with genus g and D 
any divisor with degree (D) > 2g — 2, then the dimension of the Riemann—Roch 
space associated with D, denoted by l(D) is, 


КР) = degree(D) – g + 1 


Algebraic geometry codes are the image of an evaluation map of a Riemann-Roch 
space associated with a divisor D so that 


L(D) > Е" 
1-» (СР), t(P2),---,t(Pn)) 


where 2 = (P1, P»,..., Pa, Py} is a smooth irreducible projective curve of genus 
g defined over Е,. The divisor D must һауе no points in common with a divisor 7 
associated with 2’, i.e. it has support disjoint from Т. For example, if the divisor Т 
is of the form 

T=Pi\+Po+---+ Р, 


then, D = mP,. 

Codes defined by the divisors Т and D = тр, are called one-point AG codes 
(since the divisor D has a support containing only one point), and AG codes are 
predominantly defined as so since the parameters of such codes are easily deter- 
mined [10]. 


8.3.2 Construction of AG Codes 


The following steps are necessary in order to construct a generator matrix of an AG 
code, 


1. Find the points of a smooth irreducible curve and its genus. 

2. Choose divisors D and T = Р! + --- + P,. From the Riemann-Roch theo- 
rem determine the dimension of the Riemann-Roch space L (D) associated with 
divisor D. This dimension /(D) is the dimension of the AG code. 

3. Find k = /(D) linearly independent rational functions from L(D). These form 
the basis functions of L(D). 

4. Evaluate all k basis functions on the points in the support of T to form the k rows 
of a generator matrix of the AG code. 


8.3 Curves and Planes 193 
Example 8.5 Consider again the Hermitian curve defined in Fy as, 
б, у, 0) = +y z+ yz 


1. In Example 8.2 this curve was shown to have 8 affine points and one point at 
infinity. The genus of this curve is given by the Plücker formula, 


(r — I(r —2) 
р I 


2 


where ғ = 3 is the degree of f(x, y, z). 


2. Let D = 5P where Pœ = (О: 1: 0) and T be the sum of all 8 affine points. 
The dimension of the Riemann-Roch space is then given by, 


Ц5Р.)-5-1-1-5 


thus, the АС code has dimension К = 5. 
3. The basis functions for the space L (5 Рә) are 


2 
X X X 
fiend [12 s 4 
©. 4 2 


By examining the basis, it is clear that t; = 1 has no poles, thus, (1) + D has 
no poles also. Basis functions with denominator z have (t;) = S — Poo, where S 
is a divisor of the numerator. Thus, (ti) + D has no poles. Basis functions with 
denominator 22 have (t j) = S — 2Р., where S is a divisor of the numerator. 
Thus, (1j) + D also has no poles. 

4. The generator matrix of the Hermitian code defined with divisor D = 5P is 
thus, 


(Ру) +++ (Pr) 


I (Py) +++ te(Pn) 
100000202 1 
0100002 a 0 
=/00100a la 
00010a 0 a 
00001111 


Example 8.6 Consider the curve defined in Ең as, 


Р(х, у,  =х 
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1. This curve is a straight line and has 8 affine points of the form (0 : В : 1) and one 
point at infinity (0 : 1 : 0). The curve is both irreducible and smooth. The genus 
of this curve is given by the Plücker formula, 


(т = D(r — 2) 
ш-----:-:Б:Б:Б-- = 0 
2 
where ғ = | is the degree of f (x, у, 2). Clearly, the genus is zero since the curve 
is straight line and has no bends. 
2. Let D = ӘР,, where Pœ = (0: 1: 0) and T be the sum of all 8 affine points. 
The dimension of the Riemann-Roch space is then given by, 


15Р) ==5-0+1=6 


thus, the АС code has dimension k = 6. 
3. The basis functions for the space L (5 Рә) are 


іп... — 11, 


By examining the basis, it is clear that t; = 1 has no poles, thus, (1) + D has 
no poles also. Basis functions with denominator z have (ti) = S — Р where 
S = (0: 0: 1) is a divisor of the numerator. The denominator polynomial 
z evaluates to zero at the point at infinity Pæ of the divisor D, thus, (tj) + D 
has no poles. Basis functions with denominator z? have (t5) = S — 2P% where 
S = 2 x (0:0: 1) is a divisor of the numerator. The denominator polynomial 
z? evaluates to zero at the point at infinity P5; of the divisor D with multiplicity 
2, thus, (£5) + D has no poles. Basis functions with denominator z? have (f) = 
S — ЭР, where S = 3 x (0:0: 1) is a divisor of the numerator. Thus, (t3) + D 
also has no poles. And so on. 
4. The generator matrix of the code defined with divisor D = 5 P,, is thus, 


HOP) -+ ti (Pa) 


te (Pi) (S) 


11111111 
О о o? а? аќ o? о 1 
Е 0o? a^ аб а а? а? 1 
| О0о a9 aa а at 1 
004 a оз о? аба? 1 
0 à? о? о a ata? 1 


Clearly, this is a generator matrix of an extended Reed-Solomon code with para- 
meters [3, 6, 8]a. 


8.3 Curves and Planes 195 
Theorem 8.4 (From [2]) The minimum distance of an AG code is given Бу, 
а > п – degree(D) 


Thus, ће Hermitian code defined by D = 5Р is а [8, 5, 3]4 code. The dual of an 
AG code has parameters [17], 


Dimension, kt = n — degree(D) + g — 1 
Distance, d+ > degree(D) — 2g + 2 


8.4 Generalised AG Codes 


Algebraic geometry codes and codes obtained from them feature prominently in the 
databases of best-known codes [8, 15] for an appreciable range of code lengths for 
different field sizes q. Generalised algebraic geometry codes were first presented 
by Niederreiter et al. [21], Xing et al. [13]. A subsequent paper by Ozbudak and 
Stichtenoth [14] shed more light on the construction. AG codes as defined by Goppa 
utilised places of degree one or rational places. Generalised AG codes however were 
constructed by Xing et al. using places of higher degree (including places of degree 
one). In [20], the authors presented a method of constructing generalised AG codes 
which uses a concatenation concept. The paper showed that best-known codes were 
obtainable via this construction. In [4] it was shown that the method can be effective 
in constructing new codes and the authors presented 59 codes in finite fields F4, Fg 
and Fy better than the codes in [8]. In [11], the authors presented a construction 
method based on [20] that uses a subfield image concept and obtained new binary 
codes as a result. In [19] the authors presented some new curves as well as 129 new 
codes in Ез and Fo. 


6.4.1 Concept of Places of Higher Degree 


Recall from Chap. 8 that a two-dimensional affine space A? (Е) is given by the set 
of points 


(о, B) : a, B € Fy} 
while its projective closure P? (Е, ) is given by the set of equivalence points 
П(о : В: рО (о : 1:0) О 101: 0:0): о, B € Fy}. 


Given a homogeneous polynomial F(x, у, z), a curve 2 /Е, defined in P^(F,) is a 
set of distinct points 
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Ф JF, = (T € P^(Ej) : F(T) = 0) 
Let Е, be an extension of the field F}, the Frobenius automorphism is given as 


фа, Я Е, =» Е, 
Фа(В) = B^ Be Fy 


and its action on a projective point (x : y : z) in IF, is 


bg ux : y iz) = (х : у : 27). 


Definition 8.12 (Place of Degree from [18]) A place of degree £ is a set of 2 points 
of a curve defined in the extension field Е, denoted by (70,71,...,Т) 1) where 
each Т; = i , (To). Places of degree one are called rational places. 


Example 8.7 Consider the curve in Ёл defined as, 
F(x, y,z) =x 
The curve has the following projective rational points (points of degree 1), 


(0:0:1)(0:1:1)(0:а:1)(0:02:1) 
(0:1:0) 


where o is the primitive polynomial of F4. The curve has the following places of 
degree 2, 

{00:8:1),(0:8®:1)} (O78: 0,0: 8: 0) 

I0: 8:1), (0:82: D} (0259: DOs 8^ 210 

(Oz A 21), (0:88 : DI RO: 8" 11), 0: 81: D} 


where f is the primitive element of F16. 


8.4.2 Generalised Construction 


This section gives details of the construction of generalised AG codes as described 
in [21]. Two maps that are useful in the construction of generalised AG codes are 
now described. Observe that Е, is a subfield of F, for all £ > 2. It is then possible 
to map FF, to an £-dimensional vector space with elements from IF, using a suitable 
basis. The map zr; is defined as such, 
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q 


ле(В) = (сі с2...се) Be€F,, cj € F}. 


me: Fe > FE 


Suppose (у, у, ..., Ye) forms a suitable basis of the vector space Е, then В = 
сат + оу +- -+ + сеу. Finally, the тар o¢,, is used to represent an encoding map 
from an £-dimensional message space in IF, to an n-dimensional code space, 


„тё п 
Oln : F; =F F; 


with £ < n. 

A description of generalised AG codes as presented in [4, 13, 21] is now presented. 
Let F = F(x, у, z) bea homogeneous polynomial defined in F4. Let g be the genus 
of a smooth irreducible curve 27 /Е, corresponding to the polynomial F. Also, let 
P|, P2, ..., Р, ber distinct places of 27 /Е, and k; = deg(P;) (deg is degree of). 
W is a divisor of the curve 2°/F, such that 


У-Р-Р-----Р, 


and another divisor С such that the two do not intersect.* Specifically, the divisor 
G — m(Q — R) where deg(Q) — deg(R) 4- 1 for arbitrary? divisors Q and R. As 
mentioned earlier, associated with the divisor С is a Riemann-Roch space -2 (G) 
with m — deg(G)) an integer, m > 0. From the Riemann-Roch theorem (Theorem 
8.3) it is known that the dimension of (С) is given by /(G) and 


K(G)>m-=g+1. 


Also, associated with each P; is a q-ary code C; with parameters [n;, k; = 
deg(P;), dj], with the restriction that d; < k;. Let 


(fi. Р, Us Sk : Л е £(G)} 


denote a set of k linearly independent elements of -Z (G) that form a basis. A generator 
matrix for a generalised AG code is given as such, 


Fry my Gt (PD + Ox, n, (Hk, (fi (Pr))) 
Ob, a Gt (PD) + Or, n, Tk, (f2(Pr))) 


аа Oh HPD) + сь, a (л, fel P,))) 


^This is consistent with the definition of AG codes. The two divisors should have no points in 
common. 

>These are randomly chosen places such that the difference between their degrees is 1 and С does 
not intersect W. 
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where f;(P;) is an evaluation of a polynomial and basis element f; at a place Р;, zt, 
is a mapping from F,« to Fy and оу, „, is the encoding of a message vector in Fk 
to a code vector in F7;. This is a 3 step process. The place P; is first evaluated at f; 
resulting in an element of Ее . The result is then mapped to a vector of length Ё; in the 
subfield F}. Finally, this vector is encoded with code with parameters [n;, ki, 4:14. 

It is desirable to choose the maximum possible minimum distance for all codes 
C; so that d; = k; [21]. The same code is used in the map оу, ,,, for all points of the 
same degree k;, i.e. the code C; has parameters [n ;, j, dj], for a place of degree j. 
Let A; be an integer denoting the number of places of degree j and B; be an integer 
such that 0 < B; < Aj. 

If t is the maximum degree of any place P; that is chosen in the construction, then 
the generalised AG code is represented as a 


С\(К; t; Bi, Ba, os By 4, Ф,..., di). 


Let [n, k, d], represent a linear code in Е, with length n, dimension k, and minimum 
distance d, then a generalised AG code is given by the parameters [21], 


k=l(G)>m—g+1 
a t 

n=} ni =} Вп; 
i=l j=l 


r t 
dz > d-g-krl-MBjdj-g-k-l. 


i-l j=l 

Below are two examples showing the construction of generalised AG codes. 
Example 8.8 Let F(x, y,z) = х? + xyz + xz + y?z [21] be a polynomial in F3. 
The curve 27 /IF; has genus g = 1 and A, = 4 places of degree 1 and А; = 2 places 
of degree 2. 


Table 8.4 gives the places of 27 //Еҙ up degree 2. The field F is defined by a 
primitive polynomial 52 + s + 1 with o as its primitive element. Points 


R=(l:a+a’:1) 
as a place of degree 4 and 
О= (1: +b +02: 1) 
as a place of degree 5 аге also chosen arbitrarily while а and b are primitive elements 
of Fs (defined by the polynomial s^ + s? + s? + s + 1) and Fs (defined by the 


polynomial s? + 52 + 1),g respectively. The divisor W is 


W= P +-+ Pe. 
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Table 8.4 Places of 2°/F 


3 Pi deg(Pi) 

Pi (0:1:0) 1 

P (0:0: 1) 1 

P3 (1:0: 1) 1 

Рд (1:1:1) 1 

Ps (е:1:1),(о2: |2 
1:1} 

Б (асоа--1 2 
1), (02:0: 1)} 


The basis of the Riemann-Roch space (20) with D = О — В and m = 2 is 
obtained with computer algebra software MAGMA [3] as, 


fi = (х + + х) 10 + x* + Dy 
ра а da ХЕРЦ Hx 1) 
h= (È px pa ux Бұ Dx +x + Dy 
+ G8 х 4 2) (10 х + 1) 
For the map о, „, the codes; c; а |, 1, Гр cyclic code for places of degree 1 and 
с> à [3, 2, 2] cyclic code places of degree 2 are used. For the map zr? which applies 
to places of degree 2, a polynomial basis [yi, yo] = [1, œ] is used. Only the first 


point in the place P; for deg(P;) = 2 in the evaluation of fı and f» at P; is utilised. 
The generator matrix M of the resulting [10, 2, 6]; generalised AG code over IF; is, 


M= 1101011011 
710011110101 


Example 8.9 Consider again the polynomial 
F(x,y,z) 2 x? + xyz + xz + yz 


with coefficients from IF? whose curve (with genus equal to 1) has places up to degree 
2 as in Table 8.4. An element f of the Riemann-Roch space defined by the divisor 
G — (R — Q) with 

О = (а:а+а?:1) 


апа 
R =(b:bt +b +b +b+1:1) 


where а апа b primitive elements of Ем and [Е (since the curve has no place of 
degree 3) respectively, is given by, 
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f = (х3х NS xig + z^y/G? + x37? E z) 
T G3 xz $332? + 3x? xxu + х2 +) 
Evaluating f at all the 5 places P; from the Table 8.4 and using the map Taeger, that 
maps all evaluations to F; results in, 
fF (Pi) |аев(Рд=1 
| ` 2 
[ 1[1]0]1] lla ] 
——— 
fF (Pi) |аев(Р)=2 
This forms the code [6, 1, 5]4.° In F; this becomes, 
І1|1|0|1|10 


| 11] 
—— =—— 
1 o? 


which forms the code [8, 1, 5]. Short auxiliary codes [1, 1, 1]; to encode 
F CPi) |аевср)=1 апа [3, 2, 2]? to encode f(P;) |degcp,j=2 are used. The resulting 
codeword of a generalised AG code is, 


11|110|1|101/|11 01. 


This forms the code |10, 1,7). 


Three polynomials and their associated curves are used to obtain codes in F46 better 
than the best-known codes in [15]. The three polynomials are given in Table8.5, 
while Table 8.6 gives a summary of the properties of their associated curves (with 
t = 4). ш is the primitive element of Е. The number of places of degree j, Aj, is 
determined by computer algebra system MAGMA [3]. The best-known linear codes 
from [15] over Fıs with j = d; for < j < 4 are 


[1, 1, 116 13,2,216 [5, 3.316. 17, 4, 4116 
which correspond to C1, C2, Сз and Сд, respectively. Since t = 4 for all the codes 
in this paper and 
(41,42, 43, d4] = [1, 2, 3, 4] 
The representation С|(Ё; t; Ву, B5, ..., By; di, do, ..., d;) is shortened as such, 


Ci(k; t; By, B2, ..., Br; di, do, ..., di) = Cı (k; By, В2,..., By). 


Tables 8.7 to 8.9 show improved codes from generalised AG codes with better 
minimum distance than codes in [15]. It is also worth noting that codes of the form 


ÓFrom Bezout’s dmin =n — m =n – К g 4 1. 
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Table 8.5 Polynomials in F16 
Fi = x5 + уќ + yz’ 


Р = х6 + х®у!5 + x4 + xy 4 wyb + ш“ 

Ез = х28 + wx + х18 p wlx + 1015 + 14 + 3X1 p ш?х!?2 H шх 4 3104 

wl x9 + wI2x8 + wx? + ш! буг + ш9хбу + шбхб + ш2х5у2 + ш!Зх5у + ш! 4 
ш!4х®у® + wlxty? + шбхќу + идх + ш5х3у + ш!!хЗу + wx? + 1124 + wl! y2y2 + 
шх?у + wx? + wÉxy + шбху2 + wxy + wlly8 + уќ + wy? + шу 

Table 8.6 Properties of 2; /F16 

Curve Genus 41 Аз Аз Ад Reference 
21 6 65 0 1600 15600 

25 40 225 0 904 16920 [5] 

23 13 97 16 1376 15840 [6] via [9] 


Table 8.7 New codes from .21 /F16 
Codes k Range Description # 


[70,k,d >63-К|6 |10<k x 50 Ск; [65, 0, 1, 0]) 41 


Table 8.8 New codes from 22/F16 


Code k Range Description # 

(232, К, 190 — k] 102 > k > 129 Ci (k; [225,0,0,1]) |28 
(230, k, 189 — k] 100 > k > 129 C1 (k; [225,0,1,0]) |30 
(235, k, 192 — К] 105 > k > 121 C, (Kk; [225, 0, 2, 0]) 17 


Cı(k; №, 0, 0, 0) are simply Goppa codes (defined with only rational points). The 
symbol # in the Tables 8.7 to 8.9 denotes the number of new codes from each gen- 
eralised AG code C,(k; Bj, B5, ..., Bj). The tables in [7] contain curves known to 
have the most number of rational points for a given genus. The curve .25/TFg is 
defined by the well-known Hermitian polynomial [5]. 


Table 8.9 New codes from 23/F 16 
Codes 
[102, k, 88 — k] 
[103, k, 89 — К] 
[106, k, 91 — k] k=8 


k Range Description 
Ск; [97, 0, 1, 0) 
Ск; [97, 2, 0, 0) 


C (Kk; [97, 3, 0, 0]) 1 
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8.5 Summary 


Algebraic geometry codes are codes obtained from curves. First, the motivation for 
studying these codes was given. From an asymptotic point of view, some families 
of AG codes have superior performance than the previous best known bound on the 
performance of linear codes, the Gilbert- Varshamov bound. For codes of moderate 
length, AG codes have better minimum distances than their main competitors, non- 
binary BCH codes with the same rate defined in the same finite fields. Theorems and 
definitions as a precursor to AG codes was given. Key theorems are Bezout's and 
Riemann-Roch. Examples using the well-known Hermitian code in a finite field of 
cardinality 4 were then discussed. The concept of place of higher degrees of curves 
was presented. This notion was used in the construction of generalised AG codes. 
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Chapter 9 
Algebraic Quasi Cyclic Codes 


9.1 Introduction 


Binary self-dual codes have an interesting structure and some are known to have 
the best possible minimum Hamming distance of any known codes. Closely related 
to the self-dual codes are the double-circulant codes. Many good binary self-dual 
codes can be constructed in double-circulant form. Double-circulant codes as a class 
of codes have been the subject of a great deal of attention, probably because they 
include codes, or the equivalent codes, of some of the most powerful and efficient 
codes known to date. An interesting family of binary, double-circulant codes, which 
includes self-dual and formally self-dual codes, is the family of codes based on 
primes. A classic paper for this family was published by Karlin [9] in which double- 
circulant codes based on primes congruent to +1 and +3 modulo 8 were considered. 
Self-dual codes are an important category of codes because there are bounds on their 
minimal distance [? ]. The possibilities for their weight spectrum are constrained, 
and known ahead of the discovery, and analysis of the codes themselves. This has 
created a great deal of excitement among researchers in the rush to be the first in 
finding some of these codes. A paper summarising the state of knowledge of these 
codes was given by Dougherty et al. [1]. Advances in high-speed digital processors 
now make it feasible to implement near maximum likelihood, soft decision decoders 
for these codes and thus, make it possible to approach the predictions for frame 
error rate (FER) performance for the additive white Gaussian noise channel made 
by Claude Shannon back in 1959 [16]. 

This chapter considers the binary double-circulant codes based on primes, espe- 
cially in analysis of their Hamming weight distributions. Section 9.2 introduces the 
notation used to describe double-circulant codes and gives a review of double- 
circulant codes based on primes congruent to -Е1 and +3 modulo 8. Section9.4 
describes the construction of double-circulant codes for these primes and бесі. 9.5 
presents an improved algorithm to compute the minimum Hamming distance and also 
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the number of codewords of a given Hamming weight for certain double-circulant 
codes. The algorithm presented in this section requires the enumeration of less code- 
words than that of the commonly used technique [4, 18] e.g. Sect. 9.6 considers 
the Hamming weight distribution of the double-circulant codes based on primes. 
A method to provide an independent verification to the number of codewords of 
a given Hamming weight in these double-circulant codes is also discussed in this 
section. In the last section of this chapter, Sect. 9.7, a probabilistic method— based 
on its automorphism group, to determine the minimum Hamming distance of these 
double-circulant codes is described. 

Note that, as we consider Hamming space only in this chapter, we shall omit the 
word “Hamming” when we refer to Hamming weight and distance. 


9.2 Background and Notation 


A code @ is called self-dual if, 
E = Gt 


where @+ is the dual of <. There are two types of self-dual code: doubly even or 
Туре-П for which the weight of every codeword is divisible by 4; singly even or 
Туре-І for which the weight of every codeword is divisible by 2. Furthermore, the 
code length of a Туре-П code is divisible by 8. On the other hand, formally self-dual 
(FSD) codes are codes that have 

€ EGH, 


but satisfy A% (z) = А: (2), where A(@) denotes the weight distribution of the 
code @. A self-dual, or FSD, code is called extremal if its minimum distance is the 
highest possible given its parameters. The bound of the minimum distance of the 
extremal codes is [15] 


d<4|/—|+4+e, (9.1) 


where 


—2 if € is Type-I with n = 2,4, or 6, 
€= 12, if d is Type-I with и = 22 (mod 24), or (9.2) 
0, if is Type-I or Type-II with n #22 (mod 24). 


for an extremal FSD code with length n and minimum distance d. For an FSD code, 
the minimum distance of the extremal case is upper bounded by [4] 


4<2 H gu (9.3) 
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As a consequence of this upper bound, extremal FSD codes are known to only 
exist for lengths n < 30 and n = 16 and n Æ 26 [7]. Databases of best-known, not 
necessary extremal, self-dual codes are given in [3, 15]. A table of binary self-dual 
double-circulant codes is also provided in [15]. 

As a class, double-circulant codes are (п, k) linear codes, where k — n/2, whose 
generator matrix G consists of two circulant matrices. 


Definition 9.1 (Circulant Matrix) A circulant matrix is a square matrix in which 
each row 15 a cyclic shift of the adjacent row. In addition, each column is also a 
cyclic shift of the adjacent column and the number of non-zeros per column is equal 
to those per row. 


A circulant matrix is completely characterised by a polynomial formed by its first 
TOW 


т—1 


r(x) = b3 7 


i=0 


which is called the defining polynomial. 

Note that the algebra of polynomials modulo x” — 1 is isomorphic to that of 
circulants [13]. Let the polynomial r(x) have a maximum degree of m, and the 
corresponding circulant matrix R is an m x m square matrix of the form 


r(x) (mod x" — 1) 
xr(x) (mod x" — 1) 


xir(x) (iod x" — 1) (9.4) 


x"-lr(x) (mod x" — 1) 


where the polynomial in each row can be represented by an m-dimensional vector, 
which contains the coefficients of the corresponding polynomial. 


9.2.1 Description of Double-Circulant Codes 


A double-circulant binary code is an (n, 5) code in which the generator matrix 
is defined by two circulant matrices, each matrix being 5 by 5 bits. Circulant 
consists of cyclically shifted rows, modulo 7, of a generator polynomial. These 
generator polynomials are defined as rj(x) and r2(x). Each codeword consists 
of two parts: the information data, defined as u(x), convolved with му (х) mod- 
ulo (1+ x3) adjoined with u(x) and convolved with ғ2(х) modulo (1 + x3). The 
code is the same as a non-systematic, tail-biting convolutional code of rate one 
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half. Each codeword is [u(x)ri (x), u(x)ro(x)]. If ri(x) [or r2(x)] has no common 
factors of (1 + х2), then the respective circulant matrix is non-singular and may 
be inverted. The inverted circulant matrix becomes an identity matrix, and each 


codeword is defined by u(x), u(x)r(x), where r(x) = 2™ modulo (1 + x?), [or 


r2(x) 
r(x) = 5 a modulo (1 + х2), respectively]. The code is now the same as a system- 
atic, tail-biting convolutional code of rate one half. 
For double-circulant codes where one circulant matrix is non-singular and may be 
inverted, the codes can be put into two classes, namely pure, and bordered double- 
circulant codes, whose generator matrices G and б, are shown in (9.5а) 


G,=| Ik R (9.52) 
and (9.5b), 
1... Цо 
1 
Gp = . (9.5b) 
n R т 
1 


respectively. Here, 1; is a k-dimensional identity matrix, and o c (0, 1). 


Definition 9.2 (Quadratic Residues) Leto be a generator of the finite field F ,, where 
p be an odd prime, ғ = o? (mod p) is called a quadratic residue modulo p and so is 
гі € F, for some integer i. Because the element о has (multiplicative) order p — 1 
over F,,r = o? has order i( p — 1). A set of quadratic residues modulo p, О and 
non-quadratic residues modulo p, М, are defined as 


2 i 23 РЛ 
SAT ғы Туе, —1 
0-1 | | (9.ба) 
= (02, 05,..., 0? ... , a? 3, аР! = 1) 
and 
N — (n: Vn € F,, пж Q and n £0} 
= (nr, nr’,...,nr',..., nr ,n] (9.6b) 
={# :051 5 25) 
respectively. 


As such R U QU {0} = Ё,. It can be seen from the definition of О and N that, if 
r € О, r — a for even e; and if n € М, n = а“ for odd e. Hence, if n є N and 
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гє О, rn = a”gi tl = g?U*D*! с №. Similarly, rr = а2 o? = 020+? є О and 
nn = o2itg2i+! = 220770 e 0. 
Furthermore, 
e 2€ Qifp= +1 (mod 8), and2 € N if p = +3 (mod 8) 
e —1є Qif p = 1 (mod 8) or p = —3 (mod 8), and —1 є N if p = —1 (mod 8) 
and p = 3 (mod 8) 


9.3 Good Double-Circulant Codes 


9.3.1 Circulants Based Upon Prime Numbers Congruent 
to +3 Modulo 8 


An important category is circulants whose length is equal to a prime number, p, which 
is congruent to +3 modulo 8. For many of these prime numbers, there is only a single 
cyclotomic coset, apart from zero. In these cases, 1 + х? factorises into the product 
of two irreducible polynomials, (1 + x)(1 + x + xr eee 71). Apart from 
the polynomial, (1 + x + x? + x? + --- + x?7!), all of the other 2? — 2 non-zero 
polynomials of degree less than р are in one of two sets: The set of 2?—! even weight, 
polynomials with 1 + x as a factor, denoted as Sr, and the set of 27^! odd weight 
polynomials which are relatively prime to 1 + x?, denoted as Sy. The multiplicative 
order of each set is 22-1 — 1, and each forms a ring of polynomials modulo 1 + x^. 
Any non-zero polynomial apart from (1 + x + x? +x? + --- + xP7!) is equal to 
a(x)! for some integer i if the polynomial is in Sp or is equal to а(х)! for some 
integer i if in S}. An example for p = 11 is given in Appendix “Circulant Analysis 
p = M. In this table, а(х) = 1 + x + x? + x^ and a(x) = 1 + x + x?. For these 
primes, as the circulant length is equal to p, the generator polynomial r(x) can 
either contain 1 + x as a factor, or not contain 1 + x as a factor, or be equal to 
(1 4- x 4 x? px? +--+ х7). For the last case, this is not a good choice for r(x) 
as the minimum codeword weight is 2, which occurs when u(x) = 1 + x. In this case, 
r(x)u(x) = 1 + x? = 0 modulo 1 + x? and the codeword is [1 + x, 0], a weight of 
2 

When r (x) is in the ring Sp, u(x)r (x) must also be in S; and therefore, be of even 
weight, except when u(x) = (1 + x + хф х pee. 40271). 

In this case и(х)ғ(х) = 0 modulo 1 + х? and the codeword is [1 + х + x? + 
x? +---+x?7!, 0] of weight p. When u(x) has even weight, the resulting codewords 
are doubly even. When u(x) has odd weight, the resulting codewords consist of two 
parts, one with odd weight and the other with even weight. The net result is the 
codewords that always have odd weight. Thus, there are both even and odd weight 
codewords when u(x) is from Sr. 

When r(x) is in the ring Sr, u(x)r(x) is always non-zero and is in Srp (even 
weight) only when u(x) has even weight, and the resulting codewords are dou- 
bly even. When u(x) has odd weight, u(x) = а(х)? and u(x)r(x) = a(x)/a(x)! = 
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a(x)!* and hence is in the ring Sr and has odd weight. The resulting codewords 
have even weight since they consist of two parts, each with odd weight. Thus, 
when r(x) is from S, all of the codewords have even weight. Furthermore, since 
rau a(x)’ қолай” 7717 = a(x)?" = 1 and hence, the inverse of r(x), 
Ac = a(x p-D—— A 

" By constructing a table (or sampled table) of S,, it is very straightforward to 
design non-singular double-circulant codes. The minimum codeword weight of the 
code d,,;, cannot exceed the weight of r(x) + 1. Hence, the weight of a(x)! needs to 
beatleast Amin — 1 to be considered as a candidate for r (x). The weight of the inverse 
of r(x), a(x) "1-і algo needs to be at least dmin — 1. For odd weight u(x) = a(x)/ 
and u(x)r(x) = a(x)/a(x)! = а(х). Hence, the weight of u(x)r(x) can be found 
200, by looking up the weight of a(x)'* from the table. Self-dual codes are those 


with - n" = r(x~!). With a single cyclotomic coset 25 = — 1, and it follows that 
К (p=), 
day. —a(x- D. With r(x) = a(x)’, r(x7!) = a(x) ? 1, 
In order that ДБ = r(x), itis necessary that 
20-9 Lj (p=). 
a(x) = (9.7) 


Equating the exponents, modulo 2—1) — 1, gives 
25 i = mQ VA i, (9.8) 


where m is an integer. Solving for i: 


22 т(20-)-1) 
i= ~. (9.9) 


27 +1) 


Hence, the number of distinct self-dual codes is equal to (2%? E nE 1). 
For the example, p = 13 as above, 


. 20-0 —] 4095 
і = т = т = 63т 
25-481 65 


and there аге 2257 + 1 = 65 self-dual codes for 1 < j < 65 and these are а(х)®, 
а(х)!26, a(x)!8, n a(x)495. 

As p is congruent to +3, the set (и GOr Qo)? inu to (u(x)r(x)) fort 21 >r, 
where r is the size of the cyclotomic cosets of 2з” + 1. In the case of р = 13 
above, there аге 4 cyclotomic cosets of 65, three of iste 10 and one of length 2. 
This implies that there on 4 non-equivalent self-dual codes. 


For p congruent to —3 modulo 8, Q^ + 1) is not divisible by 3. This means that 
the pure double-circulant quadratic residue code is not self-dual. Since the quadratic 


9.3 Good Double-Circulant Codes 211 


residue code has multiplicative order 3, this means that for p congruent to —3 modulo 
8, the quadratic residue, pure double-circulant code is self-orthogonal, and r(x) — 
r(x-!). 

For p congruent to 3, Qe? + 1) is divisible by 3 and the pure double-circulant 


quadratic residue code is self-dual. In this case, a(x) has multiplicative order of 
2(Р—1)_1) D : 
20-9 — 1, and а(х): з must have exponents equal to the quadratic residues 
. ы -— 20(Р-1)-1 5 
(or non-residues). The inverse polynomial is а(х) 73 — with exponents equal 


to the non-residues (or residues, respectively), and defines a self-dual circulant 
code. As an example, for p = 11 as listed in Appendix “Circulant Analysis p = 
11”, 20-9 — 1 = 1023 and а(х) = x + x? + x^ + x? + x°, the quadratic non- 
residues of 11 are 1,4, 5, 9 and 3. а(х)%2 = x? + x6 + x7 + x8 + x!° corresponding 
to the quadratic residues: 2, 8, 10, 7 and 6 as can be seen from Appendix “Circulant 
Analysis p — 11". Section9.4.3 discusses in more detail pure double-circulant codes 
for these primes. 


9.3.2 Circulants Based Upon Prime Numbers Congruent 
to +1 Modulo 8: Cyclic Codes 


MacWilliams and Sloane [13] discuss the Automorphism group of the extended 
cyclic quadratic residue (eQR) codes and show that this includes the projective special 
linear group P SL5(p). They describe a procedure in which a double-circulant code 
may be constructed from a codeword of the eQR code. It is fairly straightforward. The 
projective special linear group P S L»(p) for a prime p is defined by the permutation 


Б - mod p, where the integers a, b, c, d are such that two cyclic groups of 


order PT are obtained. A codeword of the (p + 1, PH) eQR code is obtained and 
the non-zero coordinates of the codeword placed in each cyclic group. This splits the 
codeword into two cyclic parts each of which defines a circulant polynomial. 

The procedure is best illustrated with an example. Let a € Е, be a primitive 
(p? — 1)" root of unity; then, В = 02272 is a primitive $(p + 1)™ root of unity 
since р? —1= iQp — 2)(p — 1). Let à = 1/(1 + 8) and a = A2 — А; then, the 
permutation zr, on a coordinate y is defined as 


+1 
Tı: ye —— mod p 
ay 


where лі е PSL2(p) (see Sect. 9.4.3 for the definition of PSL? (p)). As an example, 
consider the prime p — 23. The permutation zt; : y — E mod p produces the two 
cyclic groups 

(1, 5, 3, 11, 9, 13, 8, 10, 20, 17, 4, 6) 


and 
(2, 21, 7, 16, 12, 19, 22, 0, 23, 14, 15, 18). 
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There are 3 cyclotomic cosets for p — 23 as follows: 


Co = 10) 
C; = (1,2, 4, 8, 16, 9, 18, 13, 3, 6, 12} 
Cs = {5, 10, 20, 17, 11, 22, 21, 19, 15, 7, 14}. 


The idempotent given by C, may be used to define a generator polynomial, r(x), 
which defines the (23, 12, 7) cyclic quadratic residue code: 


PO =x Hx qp ux as ea Hax ad Ha Hal. (9.10) 


Codewords of the (23, 12, 7) cyclic code are given by u(x)r (x) modulo 1 + x”? and 
with u(x) = 1 the non-zero coordinates of the codeword obtained are 


(1, 2, 4, 8, 16, 9, 18, 13, 3, 6, 12) 
the cyclotomic coset СІ. 
The extended code has an additional parity check using coordinate 23 to produce 
the corresponding codeword of the extended (24, 12, 8) code with the non-zero 
coordinates: 


(1, 2, 4, 8, 16, 9, 18, 13, 3, 6, 12, 23). 


Mapping these coordinates to the cyclic groups with 1in the position, where each 
coordinate is in the respective cyclic group and 0 otherwise, produces 


(1, 0, 1,0, 1, 1, 1,0, 0,0, 1, 1) 


and 
(1, 0,0, 1, 1, 0, 0, 0, 1, 0, 0, 1) 


which define the two circulant polynomials, rı (x) and r2(x), for the (24, 12, 8) pure 
double-circulant code 


гі(х) = I4 xp a ah a 
r(x) = 1-4 x? 4 x* 4 x8 4 xl. (9.11) 


The inverse of rı (x) modulo (1 + x?) is y (x), where 
W(x) = Daeg tx E deat polt 


and this may be used to produce an equivalent (24, 12, 8) pure double-circulant code 
which has the identity matrix as the first circulant 
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Table 9.1 Double-circulant codes mostly based upon quadratic residues of prime numbers 


Prime (р) p mod8 Circulant codes Circulant codes Circulant codes “тїп 
Ор. p) Qp*2.p*D (ры) 
7 —1 (8, 4, 4) 4 
17 1 (18, 9, 6) 6 
11 3 a(22, 11, 7) B(x) (24, 12, 8) 8 
23 -1 а(24, 12, 8) 8 
13 —3 (26, 13, 7) b(x) 7 
31 -1 (32, 16, 8) 8 
19 3 (38, 19, 8) b(x) 8 
41 1 (82,41,14) (42,21,10) 10 
47 —1 2048, 24, 12) 12 
29 -3 (58, 29, 11) B(x) (60, 30, 12) 12 
71 —1 (72, 36, 12) 12 
5(72, 36, 14) 14 
73 1 (74, 37, 14) 14 
37 —3 (74, 37, 12) Ь(х) 12 
79 —1 4(80, 40, 16) 16 
43 3 (86, 43, 16) B(x) (88, 44, 16) 16 
97 1 (98, 49, 16) 16 
103 =] а(104, 52, 20) 20 
53 -3 (106, 53, 19) B(x) (108, 54, 20) 20 
113 1 (114, 57, 16) 16 
59 3 (118, 59, 19) B(x) (120, 60, 20) 20 
61 —3 (122, 61, 19) B(x) (124, 62, 20) 20 
127 -І (128, 64,20) 20 
67 3 а(134, 67, 23) B(x) (136, 68, 24) 24 
137 1 (138, 69, 22) 22 
151 -1 (152, 76, 20) 20 
83 3 (166, 83, 23) B(x) (168, 84, 24) 24 
191 -1 (192, 96, 28) 28 
193 1 (194, 97, 28) 28 
199 -І * (200, 100, 32) 32 
101 m (202, 101, 23) B(x) (204, 102, 24) 24 
107 3 (214, 107, 23) B(x) (216, 108, 24) 24 
109 -3 (218, 109, 30) b(x) 30 
223 ex (224, 112, 32) 32 
233 1 (234, 117, 26) 26 
239 =] (240, 120, 32) 32 
241 1 (242, 121, 32?) 32? 
131 3 а(262, 131, 38?) b(x) 38? 


* Codes with outstanding dmin 

Codes not based on quadratic residues 

The best (2p, p) circulant polynomial either contains the factor 1 + x: B(x) or is relatively prime 
to 1 +x”: b(x) 

B (x) circulants can be bordered to produce (2p + 2, p + 1) circulants 
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Р(х) = x? t x* x + x© 4 х0 H xly(x) modulo (1 + x!) 
Р(х) = 0 +x? + x* + x? +x! (x) modulo (1 + x!?). 


After evaluating terms, the two circulant polynomials are found to be 


fx)21 
Pale) elqTxBix a? a eg? а, (9.12) 


and it can be seen that the first circulant will produce the identity matrix of dimension 
12. Jenson [8] lists the circulant codes for primes p < 200 that can be constructed 
in this way. There are two cases, p = 89 and p = 167, where a systematic double- 
circulant construction is not possible. A non-systematic double-circulant code is 
possible for all cases but the existence of a systematic code depends upon one of the 
circulant matrices being non-singular. Apart from p = 89 and p = 167 (for p < 200) 
a systematic circulant code can always be constructed in each case. 

Table 9.1 lists the best circulant codes as a function of length. Most of these codes 
are well known and have been previously published but not necessarily as circulant 
codes. Moreover, the dmin of some of the longer codes have only been bounded and 
have not been explicitly stated in the literature. Nearly, all of the best codes are codes 


Table 9.2. Generator polynomials for pure double-circulant codes 


Code Circulant generator polynomial exponents 

(8, 4, 4) 0,1,2 

(24, 12,8) 0,1,3,4,5,6,8 

(48, 24, 12) 0, 1, 2, 3, 4, 5, 6, 8, 10, 11, 13, 14, 16, 17, 18 
(80, 40, 16) 0, 1, 5, 7, 9, 10, 11, 14, 15, 19, 23, 25, 27, 30, 38 


(104,52,20) 0,2,5,7, 10, 13, 14, 17, 18, 22, 23, 25, 26, 27, 28, 37, 38, 39, 40, 41, 42, 44, 
45, 46, 47, 48, 49 

(122,61,20) 0, 1,3, 4, 5, 9, 12, 13, 14, 15, 16, 19, 20, 22, 25, 27, 34, 36, 39, 41, 42, 45, 46, 
47, 48, 49, 52, 56, 57, 58, 60 

(134, 67,23) 0, 1, 4, 6, 9, 10, 14, 15, 16, 17, 19, 21, 22, 23, 24, 25, 26, 29, 33, 35, 36, 37 
39, 40, 47, 49, 54, 55, 56, 59, 60, 62, 64, 65 

(156, 78,22) 0,2, 3,4, 8, 9, 11, 12, 14, 16, 17, 18, 20, 22, 24, 26, 27, 29, 33, 38, 39, 41, 42, 
43, 44, 45, 46, 48, 49, 50, 52, 55, 56, 60, 64, 66, 68, 71, 72, 73, 74, 75, 77 

(166, 83,24) 1,3,4,7,9, 10, 11, 12, 16, 17, 21, 23, 25, 26, 27, 28, 29, 30, 31, 33, 36, 37, 
38, 40, 41, 44, 48, 49, 51, 59, 61, 63, 64, 65, 68, 69, 70, 75, 77, 78, 81 

(180, 90,26) 0,3, 5, 6, 7, 8, 9, 11, 12, 13, 14, 17, 18, 19, 21, 22, 23, 28, 36, 37, 41, 45, 50, 
51, 53, 55, 58, 59, 60, 61, 62, 63, 67, 68, 69, 72, 75, 76, 78, 81, 82, 83, 84, 85, 
88 

(200, 100,32) 0, 1, 2, 5, 6, 8, 9, 10, 11, 15, 16, 17, 18, 19, 20, 26, 27, 28, 31, 34, 35, 37, 38 
39, 42, 44, 45, 50, 51, 52, 53, 57, 58, 59, 64, 66, 67, 70, 73, 75, 76, 77, 80, 82, 
85, 86, 89, 92, 93, 97, 98 
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based upon the two types of quadratic residue circulant codes. For codes based upon 
р = X3 mod 8, itis an open question whether a better circulant code exists than that 
given by the quadratic residues. For p = +1 mod 8, there are counter examples. 
For example, the (72, 36, 14) code in Table 9.1 is better than the (72, 36, 12) circulant 
code which is based upon the extended cyclic quadratic residue code of length 71. 
The circulant generator polynomial g(x) for all of the codes of Table9.1 is given in 
Table 9.2. 

In Table9.1, where the best (2p, p) code is given as b(x), the (2p 4- 2, p+ 1) 
circulant code can still be constructed from f(x) but this code has the same dmin 
as the pure, double-circulant, shorter code. For example, for the prime 109, р(х) 
produces a double-circulant (218, 109, 30) code. The polynomial 6(x) produces 
a double-circulant (218, 109, 29) code, which bordered becomes a (220, 110, 30) 
code. It should be noted that 8 (x) need not have the overall parity bit border added. 
In this case, a (2p + 1, p + 1) code is produced but with the same dmin as the B(x) 
code. In the latter example, a (219, 110, 29) code is produced. 


9.4 Code Construction 


Two binary linear codes, < and 2, are equivalent if there exists a permutation л on 
the coordinates of the codewords which maps the codewords of 7 onto codewords of 
B. We shall write this as Z = zr (£). If л transforms @ into itself, then we say that 
л fixes the code, and the set of all permutations of this kind forms the automorphism 
group of Є, denoted as Аш(%). MacWilliams and Sloane [13] gives some necessary 
but not sufficient conditions on the equivalence of double-circulant codes, which are 
restated for convenience in the lemma below. 


Lemma 9.1 (cf. [13, Problem 7, Chap. 16]) Let < and B be double-circulant codes 
with generator matrices [I,|A] and [I| B], respectively. Let the polynomials a(x) 
and b(x) be the defining polynomials of A and B. The codes & and & are equivalent 
if any of the following conditions holds: 


(i) B = A", or 
(ii) b(x) is the reciprocal of a(x), or 
(ii) a(x)b(x) = 1 (mod x" — 1), or 
(iv) b(x) = a(x"), where m and и are relatively prime. 


Proof 
(i) We can clearly see that Р(х) = У" ax". It follows that b(x) = л(а(х)), 


where zt : i — m — i (mod т) and hence, & and 2 are equivalent. 
(ii) Given a polynomial a (x), its reciprocal polynomial can be written as а(х) = 
У" ax” i, It follows that a(x) = z(a(x)), where x :i— m—i-1 


(mod m). 
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(11) Consider the code c7, since b(x) has degree less than т, it can be one of the 
possible data patterns and in this case, the codeword of . has the form |b(x)|1|. 
Clearly, this is a permuted codeword of 2. 

(iv) If (u, m) = 1, then x : i — iu (mod m) is a permutation on (0, 1,..., т — 1]. 
So b(x) = а(х") is in the code z (£). 


Consider an (n, k, а) pure double-circulant code, we can see that for a given user 
message, represented by a polynomial u(x) of degree at most k — 1, a codeword of 
the double-circulant code has the form (u(x)|u(x)r(x) (mod x" — 1)). The defining 
polynomial r (x) characterises the resulting double-circulant code. Before the choice 
of r (x) is discussed, consider the following lemmas and corollary. 


Lemma 9.2 Let а(х) be a polynomial over F, of degree at most m — 1, i.e. 
a(x) = УШ ах! where aj € (0,1). The weight of the polynomial (1 + x)a(x) 
(mod x" — 1), denoted by wty((1 + x)a(x)) is even. 


Proof Let w = wty(a(x)) = wtg(xa(x)) and S = {i : diyi moam = @ 50, 0< 
i Xm — 1}: 


wty((1 + x)a(x)) = мін (a(x)) + їн (xa(x)) — 218] 
= 2(w = |$), 


which is even. 


Lemma 9.3 An m x m circulant matrix R with defining polynomial r(x) is non- 
singular if and only if r(x) is relatively prime to x" — 1. 


Proof If r(x) is not relatively prime to x" — 1, i.e. GCD (r(x), x" — 1) = t(x) for 
some polynomial t (x) Æ 1, then from the extended Euclidean algorithm, it follows 
that, for some unique polynomials а(х) and b(x), r(x)a(x) + (x" — 1)b(x) = 0, 
and therefore R is singular. 

If r(x) is relatively prime to x" — 1, i.e. GCD (r(x), x" — 1) = 1, then from 
the extended Euclidean algorithm, it follows that, for some unique polynomials 
a(x) and р(х), r(x)a(x) + (x" — 1)b(x) = 1, which is equivalent to r(x)a(x) = 1 
(mod x" — 1). Hence R is non-singular, being invertible with a matrix inverse whose 
defining polynomial is а(х). 


Corollary 9.1 From Lemma 9.3, 


(i) if R is non-singular, R ! їз anm x m circulant matrix with defining polynomial 
r(x)-!, and 
(ii) the weight of r(x) or r(x)~! is odd. 


Proof Тһе proof for the first case is obvious from the proof of Lemma 9.3. For the 
second case, if the weight of r(x) is even then r(x) is divisible by 1 + x. Since 1 + x 
is a factor of x" — ] then r(x) is not relatively prime to x" — 1 and the weight of 
r(x) is necessarily odd. The inverse of r(x)~! is r(x) and for this to exist r(x)^! 
must be relatively prime to x" — 1 and the weight of r(x)! is necessarily odd. 
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Lemma 9.4 Let p be an odd prime, and then 


(i) p | 2?-! — 1, and 
(ii) the integer q for pq = 2^-! — 1 is odd. 


Proof From Fermat’s little theorem, we know that for any integer a and a prime 


р,а?-! = 1 (mod p). This is equivalent to а?! — 1 = pq for some integer q. Let 
а — 2, we have 


which is clearly odd since neither denominator nor numerator contains 2 as a factor. 
Lemma 9.5 Let p be a prime and j (x) = Y хі; then 

(1 x) ^7! = 1+ j(x) mod (x? — 1). 
Proof We can write (1 + x)?" -! as 


р-і р-1 
а м _ (1+ х)? _ 1--х2 
14x 1+х 


From Lemma 9.4, we know that the integer q = (27^! — 1)/p and is odd. We сап 
pi 2 
then write pad ! x! in terms of J (x) as follows: 


2571.4 


> хі=1+х 
і-0 


(1 Ead] xP-1) pxPtl (1 oe ae E! xP-1) ИЕ 


a ————— 
Јо) jœ) 

х4-Эр-І (1 Ex xP!) рх4-Эр-І (1 Exe] х=) | 
...---------- — 


joo je) 


x -Dptl (1 +x ++) 
—————— 
ЈО) 
= p xj) х) 2Р1 jx) х?) +... x70! (х) (1 x?) + 


J(x) 


x «7 Dpt*l jq) 
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Since (1 + х?) (mod x? — 1) = 0 for a binary polynomial, J (x) = 0 and we һауе 


2P-1—1 
>) x = lt xx? (х) (mod x? — 1). 
i=0 


Because хі? (mod x? — 1) = 1, 


2р-1-1 
У хі=1+хј(х) (mod х?-1) 
i=0 
=1+j(x) (mod x? – 1). 


For the rest of this chapter, we consider the bordered case only and for convenience, 
unless otherwise stated, we shall assume that the term double-circulant code refers to 
(9.5b). Furthermore, we call the double-circulant codes based on primes congruent 
to +1 modulo 8, the [р + 1, i(p + 1), d] extended quadratic residue (QR) codes 
since these exist only for p = +1 (mod 8). 

Following Gaborone [2], we call those double-circulant codes based on primes 
congruent to +3 modulo 8 the [2(p+ 1), р +1, 4] quadratic double-circulant 
(QDC) codes, i.e. p = +3 (mod 8). 


9.4.1 Double-Circulant Codes from Extended Quadratic 
Residue Codes 


The following is a summary of the extended QR codes as double-circulant codes [8, 
9, 13]. 

Binary QR codes are cyclic codes of length p over Еҙ. For a given p, there exist 
four QR codes: 


1. E N, which are equivalent and have dimension +( p — 1), and 
2. Ly, Np which are equivalent and have dimension i( р + 1). 


The (р+1, i( p + 1), d) extended quadratic residue code, denoted by 2, (resp. 
Np), is obtained by annexing an overall parity check to -Y, (resp. ./,). If p = —1 
(mod 8), Ê, (resp. Np) is Туре-П; otherwise it is FSD. 

Itis well known that! Aut(Y,) contains the projective special linear group denoted 
by PSL,(p) [13]. If r is a generator of the cyclic group О, then o : i — (mod p) 
is a member of PSL2(p). Given n е №, the cycles of o can be written as 


‘Since -Zp and .// are equivalent, considering either one is sufficient. 
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(se) (n, nr, nr?, ... , nr), r, r2, ..., r (0), (9.13) 


where t — М! p — 3). Due to this property, б, the generator matrix of 2, can be 
arranged into circulants as shown in (9.14), 


connr ...nr | nr lr ...r'* r! 0 

oo 1011... 1 ] 11... 1 1l 

p 0 1 
Br 0 1 (9.14) 

br’! 0 1 

pr! 1 
where L and R are (р —1)х iQ — 1) сігсшапі matrices. The rows f, fr, ..., pr! 
in the above generator matrix contain eg(x), eg, (x), ..., ёв (х), where e;(x) = 


x'e(x) whose coordinates are arranged in the order of (9.13). Note that (9.14) can 
be transformed to (9.5b) as follows: 


|J 1JJ 1] [1 Лъжа) 
o LOIU[O ку] [0 Igon | LR wa 


(9.15) 


J + w(RT) ip J 


where J is an all-ones vector апа w(A) = [мін (Ао) (mod 2), wt (A1) 
(mod 2), ...], Aj being the ith row vector of matrix A. The multiplication in (9.15) 
assumes that L^! exists and following Corollary 9.1, мїн (I^! (x)) = wty (1(x)) is 
odd. Therefore, (9.15) becomes 


J + w(R’) I(p-4 1) 
1 
шы |. 046 
LR : 
1 


In relation to (9.14), consider extended QR codes for the classes of primes: 


1. p = 8m + 1, the idempotent e(x) = bate x" and В є М. Following [13, Theo- 
rem 24, Chap. 16], we know that eg,; (x) where Br' е N,for0 <i < t, contains 
2m + 1 quadratic residues modulo p (including 0) and 2m — 1 non-quadratic 
residues modulo p. As a consequence, мін (r(x)) is even, implying w(RT)—0 
and r(x) is not invertible (cf. Corollary 9.1); and мён (1(х)) is odd and / (x) may be 
invertible over polynomial modulo x 20-0) _ | (cf. Corollary 9.1). Furthermore, 
referring to (9.5b), we have a = (p + 1) = 4m +1 = 1 mod 2. 
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2. p = 8m — 1, the idempotent e(x) = 1+ X. ey x" and В € О. Following [13, 
Theorem 24, Chap. 16], if we have a set 8 containing 0 and 4m — 1 non-quadratic 
residues modulo p, the set 6 + S contains 2m + 1 quadratic residues modulo 
p (including 0) and 2m — 1 non-quadratic residues modulo p. It follows that 
pri (x), where Br! е О, for 0 <i < t, contains 2m quadratic residues modulo 
p (excluding 0), implying that R is singular (cf. Corollary 9.1); and 2m — 1 
non-quadratic residues modulo p, implying L^! may exist (cf. Corollary 9.1). 
Furthermore, w( R^) = 0 and referring to (9.5b), we havea = iQ + 1) = 4m = 
0 mod 2. 


For many 5222 L is invertible and Karlin [9] has shown that p = 73, 97, 127, 137, 
241 are the known cases where the canonical form (9.5b) cannot be obtained. 

Consider the case for р = 73, with В = 5 є М, we have /(х), the defining poly- 
nomial of the left circulant, given by 


Юк) = x? x3 6х4 xD ae xS xl 15 16 118, 
20 p x21 4 x25 4 30 4 431 4 32 4 433 LM 


The polynomial / (x) contains oe шы factors of x3(9-D — 1 = x36 — 1,1.е. 
GCD (1(х), x9 — 1) = 1 + x? + x^, and hence, it is not invertible. In addition to 
form (9.5b), б can also be transformed to (9.5a), and Jenson [8] has shown that, for 
7 € p < 199, except for p — 89, 167, the canonical form (9.52) exists. 


9.4.2 Pure Double-Circulant Codes for Primes +3 Modulo 8 


Recall that S, is a multiplicative group of order 27^! — 1 containing all polynomials 
of odd weight (excluding the all-ones polynomial) of degree at most p — 1, where p 
is a prime. We assume that а(х) is a generator of S}. For p = +3 (mod 8), we have 
the following lemma. 


Lemma 9.6 For p = +3 (mod 8), let the polynomials q(x) = Diego x! andn(x) = 
ae хі. Self-dual pure double-circulant codes with r(x) = q(x) or r(x) = n(x) 
exist if and only if p =3 (mod 8). 


Proof For self-dual codes the condition g(x)’ = n(x) must be satisfied where 
q(x)’ = q(x") = У сох‘. Letr (x) = q(x), forthe case when p = +3 (mod 8), 
2 М we have 46)? = = 2 eg* x” = = n(x). We know that 1 + q(x) + n(x) = j (x), 
therefore, а(х)” = 4(974(х) = = n(x)q(x) = (1+ q(x) + Ј(х))4(5) = 460 + 
n(x) + j (x) = 1. Then, 1 = = а(х)? апа q(x) = = n(x) = q(x)! =q(x7!). On 
the other hand, —1 € N if p =3 (mod 8) and thus g(x)’ = n(x). If p = —3 
(mod 8), —1 є О, we have g(x)’ = q(x). For r(x) = n(x), the same arguments 
follow. 
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Let P, denote a (2p, p, d) pure double-circulant code for p = +3 (mod 8). The 
properties of 22, сап be summarised as follows: 


1. For p =3 (mod 8), since а(х)? = 1 and a”! = 1, we have q(x) = 


a(x)Q" -D and q(x)? = а(х)" 722/3. There are two full-rank generator matri- 
ces with mutually disjoint information sets associated with 22, for these primes. 
Let С | be a reduced echelon generator matrix of 2, which has the form of (9.52) 
with R = B, where B isacirculant matrix with defining polynomial b(x) = q(x). 
The other full-rank generator matrix G2 can be obtained as follows: 


G.=| ВТ |xG,=| В? Po ik (9.17) 


The self-duality of this pure double-circulant code is obvious from Go. 

2. For p = —3 (mod 8), (p — 1)/2 is even and hence, neither g(x) nor n(x) is 
invertible, which means that if this polynomial was chosen as the defining poly- 
nomial for Y,, there exists only one full-rank generator matrix. However, either 
1 + q(x) (resp. 1 + n(x))isinvertible and the inverseis 1 + n(x) (resp. 1 + q(x)), 
i.e. 


(1+ 9(х))(1 + п(х)) = 1+ 9(х) + п(х) + qGOn(x) 
= 1+q(x)+n(x) + q(x) + jo) + 4(х)) 
= 1+q(x) + п(х) + q() + (х) ЈО) +4), 


and since q(x) /(х) = 0 and а(х)? = n(x) under polynomial modulo х? — 1, it 
follows that 


(1+ 4(0х))(1 + n(x) = 1 (mod x? — 1). 
Let G, be the first reduced echelon generator matrix, which has the form of 


(9.5a) where R = I, + О. The other full-rank generator matrix with disjoint 
information sets С can be obtained as follows: 


82 = I,-N х Gi = I,-N I, Я (9.18) 


Since —1 є О for this prime, (15 + Q)” = 1, + О implying that the (2р, р, d) 
pure double-circulant code is FSD, i.e. the generator matrix of > is given by 


Gt = I,-0 I, 
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A bordered double-circulant construction based on these primes—commonly 
known as the quadratic double-circulant construction—also exists, see Sect. 9.4.3 
below. 


9.4.3 Quadratic Double-Circulant Codes 


Let p be a prime that is congruent to +3 modulo 8. A (2(p + 1), p+ 1, d) binary 
quadratic double-circulant code, denoted by #,, can be constructed using the defin- 
ing polynomial 


1 ifp= d d 
suy + q(x) | p=3 (mod 8), ап (9.19) 
q(x) if pz —3 (mod 8) 
where q(x) = >; е0 хі. Following [13], the generator matrix С of By is 
249... [рр Fa TO +s Рр 
1 
G = : I, : В (9.20) 
1 0 
010... O |1|1... 1 


which is, if the last row of G is rearranged as the first row, the columns indexed by 
lœ and ғә are rearranged as the last and the first columns, respectively, equivalent 
to (9.5b) with a = 0 and k = р + 1. Let j(x) = 1 +x+x24.---+x?7!, and the 
following are some properties of 2, [9]: 


1. for p =3 (mod 8), bx)? = (1+ 460)? + 402) = (1+л())(1+Е@(х)) = 
1-- j(x), since g(x)? = n(x) (2 є N for this prime) and q (x) j (x) = n(x) j (x) = 
ЈО) (wt (q(x)) = wty(n(x)) is odd). Also, (Р(х) + jœ? = (10 +40) + 
JG) +40) + 0) = п) (1+ 40) + 09) = 40) tn@)+i@=1 
because n(x)? = q(x). Since —1 є М and we have Р(х) = 1+ дыр” E 
1 + n(x) and thus, b(x)b(x)" = (1 + q(x))(1 --n(x)) = 14 j (x). 

There are two generator full-rank matrices with disjoint information sets for Z,. 
This is because, although р(х) has no inverse, Р(х) + j (x) does, and the inverse 
is (b(x) + j(x))?. 

Let G, has the form of (9.5b) where R = В, and the other full-rank generator 
matrix (> can be obtained as follows: 
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en 
= 
к- 


" (9.21) 


It is obvious that б; is identical to the generator matrix of E and hence, it is 
self-dual. 

2. for p = —3 (mod 8), bœ)? = n(x)q(x) = (1+ jœ) + q60)qG0 = 1+ jQ) 
since q(x)? = n(x) (2€ М for this prime) and q(x)j(x) =n(x)j(x) = 0 
(чін(4(х)) = wta (n(x)) is even). Also, (Р(х) + jœ? = (0х) + jo) + 
n(x)) = q(x)? + q(YnG) + jo + jGnG) = п(х) +g) + jo) = 1 
because n(x)? = q(x). Since —1 є О and we have Р(х)! = Жар” = b(x) 
and it follows that 2, is FSD, i.e. the generator matrix of m is given by 


01...11/0...0 
pil 0 

| В (| dp 

1 0 


Since (b(x) + j())*! = (р(х) + JD there exist full-rank two generator 
matrices of disjoint information sets for Z,. Let G, has the form of (9.5b) where 
R = В, and the other full-rank generator matrix G2 can be obtained as follows: 


Ц1...1 01...111/0...0 
1 
С = |. хб. =. | (9.22) 
| B? | В? Ne), I, 
0 1 0 


Codes of the form 2, form an interesting family of double-circulant codes. 
In terms of self-dual codes, the family contains the longest extremal Type-II code 
known, n = 136. Probably, it is the longest extremal code that exists, see Sect. 9.7. 
Moreover, 2, is the binary image of the extended QR code over F4 [10]. 

The (p + 1, ip + 1), d) double-circulant codes for p = +1 (mod 8) are fixed 
by PSL2(p), see Sect. 9.4.1. This linear group PSL» (p) is generated by the set of all 
permutations to the coordinates (оо, 0, 1,..., p — 1) of the form 


ay +b 


, 9.23 
cy +а Pn 


where a, b, c, d € Fy, ad — bc = 1, y € F, {оо}, and it is assumed that ti — oo 
1 


and + = = 0 in Ше arithmetic operations. 
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We know from [13] that this form of permutation is generated by the following 
transformations: 


S: y—>y+l 

У:у-а? (9,24) 
1 

То у=; 
y 


where о is a primitive element of F ,. In fact, V is redundant since it can be obtained 
from 5 and T, i.e. 


V-TS'"TS"TS* (9.25) 


for? —aeF,. 

The linear group РЅ1 (р) fixes not only the (p + 1, М! p +1), d) binary double- 
circulant codes, for p = +1 (mod 8), but also the (2(p+ 1), p + 1, d) binary 
quadratic double-circulant codes, as shown as follows. Consider the coordinates 
(оо, 0, 1, ..., p — 1) of a circulant, the transformation $ leaves the coordinate оо 
invariant and introduces a cyclic shift to the rest of the coordinates and hence S fixes 
a circulant. Let R; and L; denote the ith row of the right and left circulants of (9.20), 
respectively (we assume that the index starts with 0), and let J and J' denote the 
last row of the right and left circulant of (9.20), respectively. 

Consider the primes p = 8m + 3, Ro = (0 | 1+ Sieg x"). Let e; and fj, for 
some integers i and j, be even and odd integers, respectively. If i € О, —1/i = 
—] x a?! ой = af x 07% е М since —1 є М for these primes. Therefore, the 
transformation Т interchanges residues to non-residues and vice versa. In addition, 
we also know that Т interchanges coordinates оо and 0. Applying transformation T 
to Ro, T (Ro), results in 


T(R) = | 1 Dox!) = Ro J. 


jeN 


Similarly, for the first row of L, which has 1 at coordinates оо and 0 only, i.e. 
Lo — (0| 1) 


T (Lo) = Lo + J. 


ITST SHTS (y) = TS TST (y а) = TS" TS (-y- a) = 7587 (— 1. +a) 
5%7 
Бр Tse ау! +ош-1 T {= T (== ши 
ук m —y-len T —(ra)- Tg Б пу+(«н—1) Ж 


(-ош ут! +а(ош D-a) __ о PE 
( -uy -F(ap-1) ) (=) ary = Vy). 
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Lets € Qandlettheset Ô = QU {0}, R, = (o Died x) апат (Sar) = 
Хо x7 "Ct. Following MacWilliams and Sloane |13, Theorem 24, Chap. 16], we 
know that the exponents of У, có x5ti contain 2т +1 residues апа 
2m + 1 non-residues. Note that s +i produces no 0 It follows that —1/(s + 
i) contains 2m + 1 non-residues and 2m + 1 residues. Now consider R ;,, = 
(o | Died y, i — 1/s contains^ 0 i,s € Q, 2m residues and 2m + 1 non- 
residues. We can write —1/(s + i) as 
1 i/s 1 1 


7 = 3 =: А 
5+1 5+1 5 5 


Let ТС Ó be a set of all residues such that for all i € J, i — 1/s € N. If —1/ 
(6+0) є N,ze 0 and we can see that z must belong to J such that z — 1/5 є М. 
This means these non-residues cancel each other in T(R,) + R_1/;. On the other 
hand, if —1/(s +i) € О, z e М and it is obvious that z — 1/5 Ai — 1/s for all 
ic 0, implying that all 2m + 1 residues in T(R;) are disjoint from all 2m + 1 


residues (including 0) in Ж. 1/;. Therefore, T (Rs) + R-1;s = (o | Died xi), le. 
T(Rs) = R-1/s + Ro. 
Similarly, 7(1,) = (0 | 1 + x7") and Lj, = (1 | x7'/*), which means 


T(Ls) = Гу + Lo. 


Lett € N, R, = (01 37,5) and T (ох) = Dieg x Vt). We know 
that t + i contains 0, 2m residues and 2m + 1 non-residues [13, Theorem 24, Chap. 
16], and correspondingly —1/(t +i) contains оо, 2m non-residues and 2m + 1 


residues. As before, now consider Ё; = (0 РЭ zu There are 2m +1 


residues (excluding 0) and 2m + 1 non-residues in i — 1/7, and let I’ С Ó be a 
set of all residues such that, for all i € I’, i — 1/t € Q. As before, we can write 
—l/(t +i) as z — 1/1, where z = (i/t)/(t +i). If —1/(t--i) e О, ze and 
hence, the 2m + 1 residues from —1/(t +i) are identical to those from i — 1/1. 
If —1/(t 4- i) € М, z є М and hence, all of the 2m non-residues of —1/(t + i) 
are disjoint from all 2m + 1 non-residues of i — 1/1. Therefore, T (R;) + Ку; = 


(1) Xie!) ie 


T(R) = Ку, + Ro * J. 


3Consider a prime p = +3 (mod 8), q € О and an integer a where (a, p) = 1. In order for 
а + а = 0 to happen, a = —q. The integer а is a residue if p = 8m — 3 and a non-residue if 
р = 8m-43. 


"This is because all i € О are considered and 1 /s € Q. 
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Similarly, T(L;) = (0 | 1 4- x-!/') and L jj, = (1 | x71"), which means 
T(L,) = Lj + Lo J’. 


For primes p = 8m — 3, Ro = (0 | Уго) апа since —1 є О, —1/i є О for 
i € Q. Thus, 


T(R) = [0] Ух | = Ro. 
ieQ 


Similarly, for Lo, which contains 1 at coordinates 0 and оо, 
T (Lo) = Lo. 


Consider №, = (0 | > x°"), fors € О,Т (Уо x") = Sieg x7 CH. There 
аге 0 (when i = —s € О), 2m — 2 residues and 2m — 1 non-residues in the set 
s +i [13, Theorem 24, Chap. 16]. Correspondingly, —1/(s +i) = z — 1/5, where 
z = (i/s)/(s + i), contains oo, 2m — 2 residues and 2m — 1 non-residues. Now con- 
sider В. jj, = (0 | 2 eg x/-!/5), the set i — 1/s contains 0 (when i = 1/s € О), 
2m — 2 residues and 2m — 1 non-residues. Let J C О be a set of all residues such 
that for alli € Z, i — 1/s є Q. If —1/(s +i) є О then z — 1/s є О which means 
z € О and z must belong to Г. This means all 2m — 2 residues of —1/(s + i) and 
those of i — 1/5 are identical. On the contrary, if —1/(s + і) є №, z є № and this 
means z — 1/5 Æ i — 1/sforalli є О, and therefore all non-residues in — 1/(s + i) 
and i — 1/s are mutually disjoint. Thus, T(R;) + R ij, = (1 [1+ У; xi), i.e. 


T(Rs) = Ку; + Rot J. 
Similarly, T(L,) = (0 [1+ ат апа we can write 
T(L,) = Ly; + Lo *- Л. 


Fort є №, wehave R, = (0| У, сох!) andT(Dicg x**) = Djeg x! . Fol- 
lowing |13, Theorem 24, Chap. 16], there are 2m — 1 residues and 2m — 1 non- 
residues in the set t + i and the same distributions are contained in the set —1/(t + i). 
Considering R_1/; = (0 | ico хі 1"), there are 2m — 1 residues and 2m — 1 non- 
residues in i — 1/1. Rewriting —1/(t +1) = z — 1/t, for z = (i/t)/(t +i), and 
letting /' C О be a set of all residues such that for all i € /', i — 1/t € М, we 
know that if —1/(t +i) € № then z — 1/t є N which means that z є О and z 
must belong to 7’. Hence, the non-residues in i — 1// and —1/(t + i) are iden- 
tical. If —1/(t +i) € Q, however, z e N апа for all i € Q, i —1/t ж: – 1/1, 
implying that the residues in —1/(t +i) and i — 1/t are mutually disjoint. Thus, 
T(R) + Ray = (0 | Jegi h i.e. 
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T(R) = Еу; + Ro. 

Similarly, T(L;) = (0 [1+ gt). and we can write 
T(L,) = Lip + Lo. 


The effect T to the circulants is summarised as follows: 


T for p = 3 (mod 8) for p = —3 (mod 8) 
T (Ro) Ro J Ro 
T (Rs) R5; + Ro Rij, + J 
T(R;) К. + Roc J Ray; Ro 
T (Lo) Lot J Lo 
T(L;) Lijs + Lo Lay J’ 
T(L;) Іл. c Lo J’ Lij + Lo 
where s е О and t € М. This shows that, for p = +3 (mod 8), the transformation 


Т is а linear combination of at most three rows of the circulant and hence it fixes the 
circulant. This establishes the following theorem on Aut(ZZ,) [2, 131. 


Theorem 9.1 7heautomorphism group ofthe (2(p 4- 1), p 4- 1, d) binary quadratic 
double-circulant codes contains PSL2(p) applied simultaneously to both circulants. 


The knowledge of Аш(:2,) can be exploited to deduce the modular congruence 
weight distributions of 2, as shown in Sect. 9.6. 


9.5 Evaluation of the Number of Codewords of Given 
Weight and the Minimum Distance: A More Efficient 
Approach 


In Chap.5 algorithms to compute the minimum distance of a binary linear code 
and to count the number of codewords of a given weight are described. Assuming 
the code rate of the code is a half and its generator matrix contains two mutually 
disjoint information sets, each of rank k (the code dimension), these algorithms 
require enumeration of 


k w/2—1 k 
ы „ы () 


codewords in order to count the number of codewords of weight у. For FSD double- 
circulant codes with p = —3 (mod 8) and self-dual double-circulant codes a more 
efficient approach exists. This approach applies to both pure and bordered double- 
circulant cases. 
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Lemma 9.7 Let Т,(х) be a set of binary polynomials with degree at most т. 
Let uj(x), (х) € Ty (x) for i = 1,2, and e(x), f (x) € Ty 2(х). The numbers of 
weight w codewords of the form c\(x) = (ui1(x)|vi(x)) and с›(х) = (va(x)lus (x)) 
are equal, where 


(i) for self-dual pure double-circulant codes, из (x) = и (x)! апау (х) = vi (x)'; 
(ii) for self-dual bordered double-circulant codes, u(x) = (ele(x)), vi(x) = 
(УРО), u3(x) -(е|е(х)7) апа у(х) = Qf 601), where y = wty(e(x)) 
(mod 2); 
(ii) for FSD pure double-circulant codes (p = —3 (mod 8)), u2(x) = uj (x)? and 
у(х) = vi(x)?; 
(іу) for FSD bordered double-circulant codes (p = —3 (mod 8)), ui (x)-(e|e(x)), 
vi(x) = (у|/()), ma) = (є|е(х)?), у(х) = If), where y = мін 
(e(x)) (mod 2). 


Proof 


(i) Let G; = [J;|R] and G2 = [К Tu к] be the two full-rank generator matrices 
with mutually disjoint information sets of a self-dual pure double-circulant code. 
Assume that г (x) and r(x)? are the defining polynomials of G; and G», respec- 
tively. Given и1(х) as an input, we have a codeword c; (x) = (ui (х) [у (x)), 
where v; (x) = uj(x)r(x), from С. Another codeword c5(x) can be obtained 
from С» using и (x) as an input, co(x) = (vi (х) [ui1(x)7), where vı (x)? = 
uj (x) r(x)? = (ui (x)r(x))’. Since the weight of a polynomial and that of its 
transpose are equal, for a given polynomial of degree at most k — 1, there exist 
two distinct codewords of the same weight. 

(ii) Let С, given by (9.5b), and б be two full-rank generator matrices with pair- 
wise disjoint information sets, of bordered self-dual double-circulant codes. It is 
assumed that the form of б; is identical to that given by (9.21) with КТ = BT. 
Let f(x) = e(x)r(x), consider the following cases: 


a. € = 0 and мін (е(х)) is odd, we have a codeword сі(х) = (0 | e(x) | 1| 
f (x)) from бі. Applying (0 | е(х)Т) as an information vector to G2, we 
have another codeword с>(х) = (1 | eG)" (х) | 0| eœ) = (11 РО)” 
[0] e(x)7). 

b. e—1 and wtg(e(x) is odd, G, produces сі(х)- (| e(x) | 1| 
f GÀ) + j x». Applying (1 | е(х)”) as an information vector to G2, we have a 
codeword c2(x)= (1 | eG) ro)? + ](х)|1| e(x)") = (1 | РО) + 
jx) 111eQ)7). 

c. e = Qand wtg (e(x)) is even, Сі producesacodeword cı (x) = (0 | e(x) | 0 | 
f (x). Applying (0 | e(x)T) as an information vector to Gz, we have another 
codeword c2(x) = (0 | e(x) r(x)? [0 | е(х)”) = (0 | f(x)? 40] ela). 

d. = = 1 and мін (e(x)) is even, бі produces сі(х)- (1 | е(х) 10| f(x)4 
j(x)). Applying (1 | е(х)7) as ап information vector to G2, we һауе a code- 
word cQ) = (0 | eœ) Tro + jo) | 11 e@)") = (01 f C97 + J) 
111 e(x)"). 
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It is clear that in all cases, мн (сі (х)) = wtg(co(x)) since wtg(v(x)) = 
wty(v(x)") and мн (у(х) + Ј(х)) = wta (v(x)? + Ј(х)) for some polyno- 
mial v(x). This means that given an information vector, there always exist two 
distinct codewords of the same weight. 

(ш) Let G1, given by (9.5a) with R = Г, + О, and Gz, given by (9.18), be two full- 

rank generator matrices with pairwise disjoint information sets, of pure FSD 
double-circulant codes for p = —3 (mod 8). 
Given u(x) as input, we have a codeword cı(x) = (uj(x)|vi(x)), where 
у(х) = и1(х)(1 + q(x)), from бі and another codeword сз (х) = (vo(x)|ua 
(x)), where иҙ(х) =u (x) апі v(x) = и(х)2(1 + n(x)) = и1(х)?(1 
+4 (x)? = vi (x)?, from С». Since the weight of a polynomial and that of its 
square are the same over Еҙ, the proof follows. 

(iv) Let G;, given by (9.5b) with B = R, and Go, given by (9.22), be two full-rank 
generator matrices with pairwise disjoint information sets, of bordered FSD 
double-circulant codes for p = —3 (mod 8). Let f(x) = e(x)b(x), consider 
the following cases: 


a. = = Oand wtg (е(х)) is odd, we have a codeword cı (x)= (0 | ебх) | 1| f(x» 
from С. Applying (0 | е(х)?) as an information vector to Сз, we have 
another codeword c2(x) = (1 | e(xYn(x)|0| е(х)?). Since е(х)2п(х) = 
е(х)?Ь(х)? = f (xy), the codeword c; = (1 | f(x) |0| e(x)?). 

b. e= 1 and wty(e(x)) is odd, бі produces ci(x) = (1 | е(х) | 1| f(x) 
cj (x). Applying (1 | е(х)2) as an information vector to G2, we һауе a 
codeword c5(x) = (1 | е(х)?п(х) + f(x) | 1 | eQ)?) = (11 ЛО)? + joo 
| 1 | е(х)?). 

c. в = О and мін (e(x)) is even, бі produces a codeword cı (х) = (0 | ебх) |0 
| f(x)). Applying (0 | е(х)?) as an information vector to G2, we һауе 
another codeword c2(x) = (0 | е(х)2п(х) | 0 | е(х)2) = (0] f(x)? | 0 
| е(х)2). 

d. == 1 and wty(e(x)) is even, G, produces сі(х) = (1 | e(x) 101 f(x) 
cj (x). Applying (1 | е(х)?) as an information vector to G2, we һауе а 
codeword c2(x) = (0 | e(x)?n(x) + f(x) | 1 | е(х)2) - (0 | f + fx) 
111 е(х)2). 


It is clear that in all cases, мн (сі (х)) = wtg(co(x)) since wtg(v(x)) = 
wtg (v(x)2) and wtg (v(x) + J(x)) = мін (v(x)? + J (x)) for some polynomial 
v(x). This means that given an information vector, there always exist two distinct 
codewords of the same weight. 


From Lemma 9.7, it follows that, in order to count the number of codewords of 


weight w, we only require 
x() 
i 
i=l 


codewords to be enumerated and if A,, denotes the number of codewords of weight w, 
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w/2—1 
Ay = 4,52 Уа (9.26) 
i=l 


where а; is the number of weight w codewords which have і non-zeros in the first k 
coordinates. 

Similarly, the commonly used method to compute the minimum distance of half- 
rate codes with two full-rank generator matrices of mutually disjoint information 
sets, for example, see van Dijk et al. [18], assuming that d is the minimum distance 
of the code, requires as many as 


d/2-1 


a (‘) 


codewords to be enumerated. Following Lemma 9.7, only 8/2 codewords are 
required for 22, and &, for p = —3 (mod 8), and self-dual double-circulant codes. 
Note that the bound d/2 — 1 may be improved for singly even and doubly even codes, 
but we consider the general case here. 


9.6 Weight Distributions 


The automorphism group of both (p + 1, i(p + 1), d) extended QR and (2(p + 
1), p + 1, d) quadratic double-circulant codes contains the projective special linear 
group, PSL2(p). Let # be a subgroup of the automorphism group of a linear code, 
and the number of codewords of weight i, denoted by А;, сап be categorised into 
two classes: 


І. aclass of weight i codewords which are invariant under some element оҒ. 2; and 

2. aclass of weight i codewords which forms an orbit of size | |, the order of 2. 
In the other words, if с is a codeword of this class, applying all elements оҒ. 
to c, |І distinct codewords are obtained. 


Thus, we can write A; in terms of congruence as follows: 


A; =n; x |J€| + АЖ), 


9.27 
= A;(7€) (mod |.) en) 
where А, (2) is the number of codewords of weight i fixed by some element of 
Jf. This was originally shown by Mykkeltveit et al. [14], where it was applied to 
extended QR codes for primes 97 and 103. 


9.6 Weight Distributions 231 


9.6.1 The Number of Codewords of a Given Weight 
in Quadratic Double-Circulant Codes 


For 2, we shall choose # = PSL2(p), which has order |Ж| = ip — 1). Let 
the matrix [55 2 ] represent an element of PSL2(p), see (9.23). Since |#| can be 
factorised as |.#| = II; qi, , where 4; is a prime and e; is some integer, А; (7) 
(mod |.#|) can be obtained by applying the Chinese remainder theorem to А; (Sy, ) 
(mod а; ) for all q; that divides |. |, where S4, is ће Sylow-q;-subgroup of 2. 
In order to compute А; (S,,), a subcode of 4, which is invariant under S,, needs to 
be obtained in the first place. This invariant subegde: in general, has a poneideralily 
smaller dimension than &,, and hence, its weight distribution can be easily obtained. 

For each odd prime qj, 54, is a cyclic group which сап be generated by some 
ГЕ A е Р512(р) of order qj. Because 54, is cyclic, it is straightforward to obtain 
the invariant subcode, from which we can compute A; (Sq, ). 

On the other hand, the case of q; — 2 is more complicated. For д; = 2, 52 isa 
dihedral group of order 2"*!, where m + 1 is the maximum power of 2 that divides 
ЖІ? ]. For p = 8m + 3, we know that 


Жі- 5 (m + 3) ((8m + 3) — 1) = 2? (64n? + 72m? + 26m + 3), 


which shows that the highest power of 2 that divides |. | is 2? (m — 1). Following 
[? |, there are 2" + 1 subgroups of order 2 in 852, namely 


Н» = (4, Pj, 
G9 = (1, T), and 
G} = {1, PT}, 


where P, T € PSL;(p), P? = T? = 1 and TPT! = Р-!. 

Let T = | 1 Ж ], which has order 2. It can be shown that any order 2 permutation, 
Р- ГЕ AT if a constraint b — c is imposed, we have a — —d. All these subgroups, 
however, are conjugates in PSL3(p) |? | and therefore, the subcodes fixed by G9, Gi 
and Н» have identical weight distributions and considering any of them, say С, is 
sufficient. 

Apart from 2" + 1 subgroups of order 2, 8; also contains a cyclic subgroup of 
order 4, 27-1 non-cyclic subgroups of order 4, and subgroups of order 2/ for j > 3. 

Following [14], only the subgroups of order 2 and the non-cyclic subgroups of 
order 4 make contributions towards А;(92). For p = +3 (mod 8), there is only 
one non-cyclic subgroup of order 4, denoted by G4, which contains, apart from an 
identity, three permutations of order 2 [? ], i.e. a Klein 4 group, 


Gs = (1, P, T, PT}. 
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Having obtained A; (G9) and A; (Сд), following the argument in [14], the number of 
codewords of weight i that are fixed by some element of 52 is given by 


А 59) = 3A; (G2) —2A;(G4) (mod 4). (9.28) 


Іп summary, іп order to deduce the modular congruence of the number of weight 
i codewords іп 2, it is sufficient to do the following steps: 


1. compute the number of weight i codewords in the subcodes fixed by G9, G4 and 
Sq for all odd primes q that divide |.|; 

2. apply (9.28) to Ai(G9) and А; (Сд) to obtain А; (52); and then 

3. apply the Chinese remainder theorem to A; (52) and all A; (5,) to obtain A; (27^) 
(mod |.2£ |). 


Given 2, and an element of PSL2(p), how can we find the subcode consisting of 
the codewords fixed by this element? Assume that Z — [4 | е PSL2(p) of prime 
order. Let cj, (resp. c,,) апа cj, (resp. с,,) denote the ith coordinate and л (i)th 
coordinate (ith coordinate with the respect to permutation л2), in the left (resp. 
right) circulant form, respectively. The invariant subcode can be obtained by solving 
a set of linear equations consisting of the parity-check matrix of 2, (denoted by 
Н), с, + сі, = 0 (denoted by x z (L.)) and c,, + с,, = 0 (denoted by x z (R)) for all 
i € F, U {ov}, ie. 


H 
Н, = 


л2(1) 
xz(R) 


The solution to H sup isa matrix ofrankr > (p + 1), whichis the parity-check matrix 
of the (2(p + 1), 2(p + 1) — r, d) invariant subcode. For subgroup Сд, which con- 
sists of permutations P, T and РТ, we need to solve the following matrix 


H 


x p(L) 
H yup = лр(К) 
лт(1) 
xr(R) 
m pr(L) 
x pr(R) 


to obtain the invariant subcode. Note that the parity-check matrix of ZZ, is assumed 
to have the following form: 
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lo lo Ір-1 Fa 0... Рр 
0 1 

1 
111 1100. 0 


One useful application of the modular congruence of ће number of codewords 
of weight w is to verify, independently, the number of codewords of a given weight 
w that were computed exhaustively. 

Computing the number of codewords of a given weight in small codes using a 
single-threaded algorithm is tractable, but for longer codes, it is necessary to use 
multiple computers working in parallel to produce a result within a reasonable time. 
Even so it can take several weeks, using hundreds of computers, to evaluate a long 
code. In order to do the splitting, the codeword enumeration task is distributed among 
all ofthe computers and each computer just needs to evaluate a predetermined number 
of codewords, finding the partial weight distributions. In the end, the results are 
combined to give the total number of codewords of a given weight. There is always 
the possibility of software bugs or mistakes to be made, particularly in any parallel 
computing scheme. The splitting may not be done correctly or double-counting or 
miscounting introduced as a result, apart from possible errors in combining the partial 
results. Fortunately, the modular congruence approach can also provide detection of 
computing errors by revealing inconsistencies in the summed results. The importance 
of this facet of modular congruence will be demonstrated in determining the weight 
distributions of extended QR codes in Sect. 9.6.2. In the following examples we work 
through the application of the modular congruence technique in evaluating the weight 
distributions of the quadratic double-circulant codes of primes 37 and 83. 


Example 9.1 For prime 37, there exists an FSD (76,38, 12) quadratic double- 
circulant code, 437. The weight enumerator of an FSD code is given by Gleason's 
theorem [15] 


18] 
A(z) = У Kiü + 27)? R — 224 + 25)! (9.30) 
i=0 


for integers K;. The number of codewords of any weight w is given by the coefficient 
of z" of A(z). In order to compute A(z) of 437, we need only to compute A»; for 
6 <i < 9. Using the technique described in Sect.9.5, the number of codewords of 
desired weights is obtained and then substituted into (9.30). The resulting weight 
enumerator function giving the whole weight distribution of the (76, 38, 12) code, 
буу 15 


(9.31) 
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? x 32 х 19 x 37 = 25308. Con- 


2 
1 
1 


sider the odd primes as factors 4. For 4 — 3, (ЕЕ | generates the following permu- 


tation of order 3: 


3626095793 x (2254-24) + 9404812736 x (20 + 2*6) + 
19610283420 х (2? + 2“) + 33067534032 х (2*4+ z?) + 


7489059 x (220 + 236) + 53574224 x (z? + 2) + 
275509215 x (24--27) + 1113906312 x (226 + 20) + 


45200010670 x (z? + 2%) + 50157375456 x z”. 


86469 х (216-- 2) + 961704 х (z!8 + 255) + 
(11)(14, 17, 30)(15, 29, 33) (16, 32, 31) (20, 35, 25) 26, 34, 28) (27) 


PSL (37), and we know that | 


(co, 0, 1) (2, 36, 19) (3, 18, 13)(4, 12, 10) (5, 9, 23)(6, 22, 7) (8, 21, 24) 


A(z) = (1+ 276) + 2109 x (22 + z“) + 
The corresponding invariant subcode has a generator matrix С) of dimension 14, 


which is given by 


Let # 
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Dm Xia owl 


ocoooocoooco-oooco 


ooooooooooooo- 
2255524 {йерей КЕН 


Soe oo-coc- 
-зсо-с-----с-ос- 
mmc concen 
-Фо---с-с-ос-о 
әсетт-- oocc-o-co-c 
ә----- ee--e-ce-c 
Dommen oocoo- 
-5о-о---550о25- 


-оооооооооооое 


ПЕН наны 
Il 


Е 
2 
5 


(9.32) 


(1+ ze) +3 х (г? + p + 24 x @ + 22”) + 
54 х Ge zb z^’) 4 150 x (z2? + 259) NE 176 x (227 +) ap 


171 x (z^* + z?) + 468 x (27° + 270) + 788 x (2? +z“) + 
980 x (220 + 24°) + 1386 x (z? +z“) + 1350 x (2* +z”) + 


1573 x (23% + 2) + 2136 х 25. 
(co, 0, 25, 5, 18, 32, 14, 10, 21, 2, 1, 19, 30, 26, 8, 22, 35, 15, 3) 


(4, 36, 28, 34, 31, 33, 16, 17, 29, 27, 20, 13, 11, 23, 24, 7, 9, 6, 12). 


АЗ (г) 
The resulting generator matrix of the invariant subcode С), which has dimension 


For 4 = 19, lee 1] generates the following permutation of order 19: 
2,18 


and its weight enumerator function is 


235 
(9.33) 


AS) (7) = 1-- 2278 +z”. 
] and it turns out that the corresponding invariant subcode, and 


[ ? 3% |, and the resulting order 2 permutations generated by Р, 


1 


36 35 


0 
(11, 34)(12, 14) (13, 36) (15) (19, 28) 20, 24) 23, 27) 32) (33, 35) 


1, 12, 29, 31, 28, 16, 2, 9, 10, 3, 22, 20, 5, 21, 8, 11, 17, 35) (36) 
(14, 29) (15, 32) (16, 30) (19, 35) (20, 24) 25, 34) (26, 27) Q8, 33) (31) 
(12, 29) (15, 32) (17, 36) (18, 21) (19, 33) (20) 23, 26) 24) 28, 35) 


(oo, 0, 18, 24, 27, 14, 30, 15, 13, 32, 25, 26, 33, 19, 7, 4, 6, 23, 34, 


For q — 2, subcodes fixed by some element of G? and G4 are required. We have 
(оо, 0)(1, 36) 2, 18) 3, 12) (4, 9) (5, 22)(6)(7, 21) (8, 23)(10, 11)(13, 17) 


P = [35] and T 


T and PT are 
(co, 5)(0, 22) (1, 17) 2, 21) (3, 29) (4, 16) (6, 31) (7, 18) (8, 26) (9, 30) (10, 25) 


(оо, 22)(0, 5)(1, 13)(2,7)(3, 14) (4, 30)(6, 31)(8, 27) (9, 16) (10, 34) (11, 25) 
respectively. It follows that the corresponding generator matrices and weight enu- 


hence, the weight enumerator function, are identical to those of q — 19. 
merator functions of the invariant subcodes are 


For the last odd prime, 4 - 37, a permutation of order 37 


and its weight enumerator function is 


9.6 Weight Distributions 
is generated by | 


апа 


Е] 


cooocooooocoooocooo-o 
cooocoooooo-oocooooooco 
ooooooo-oooooooooooo 
coooooooooco-ooocooooo 
cooocooooooooooo-oococo 
ooooooooooooooooooo- 
coo-oocooooocoooocooooo 
ооооооооооооооооо-оо 
ocooooooo-ooooooooooo 
ооооооооооооо-оооооо 
ооооооооо-оооооооооо 


т-с--ссо--т-сссососс-со-с 
-сос------- сәс--ос-соос 
--з--с---ссссссс-сос-с 
e--ocoec-ceecclco coco 


ооооооооооооооооо-оо 
оооооооооооооооо-ооо 
ocooooooooooooooc-oooo 
оооооооооооооо-ооооо 
ооооооооооооо-оооооо 
ocooooooooooo-oocooooo 
coooooooooco-cooocooooco 
ocooooooooo-ooooooooo 
ocoooooooo-oooooooooo 
оооооооо-ооооооооооо 
ocoooooo-oooooooooooo 
ocooocoo-coooooooocooooo 
ооооо-оооооооооооооо 
oooocooooooooooooooo 
ocoo-ooooooooooococoooo 
оо-ооооооооооооооооо 
ocoooooooooooooooooo 
—ooocoooooooooocooooo 


GCD 
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which has dimension 20, with 


A(z) = (1 +27) +21 x (212 + 25) + 153 x (216 + 2) + 
744 х (218 + 258) + 1883 x (220 + 255) + 4472 х (z? +z”) + 
10119 x (22* +z”) + 21000 x (226 + 2°) + 36885 x (278 + 2“) + 
58656 x (z^? + 2*°) + 85548 х (27° + z“) + 108816 x (2 + z?) + 
127534 x (z*° + 240) + 136912 x 5% 


and 
1000000000001101101011011101000110111011111000111000100001000000000010000000 
0100000000000000010100111000110001000110000111010110000100000000000000000000 
0010000000001101101010000101000100110000001000000000000000100000000000010100 
0001000000001111111111111111111111111111111111111000000000000000000000000000 
0000100000000000010100100000110011000100010111101000010000000010100000000000 

GG» iam 0000010000001101101111000101100101111101101011000000001000010000001000000000 

== 0000001000001100101101011101100000011011101011010000000010000000000000000000 , 

0000000100000001100011000101100111101101111001101000000000000000010000000000 
0000000010000000110000111101110010000010011101111000000000000000000000100000 
0000000001001100001101011000100001011111100011010000000000001100000000001000 
0000000000100000100101000101100011001101111011101000000000000000000001000011 
0000000000011100111000111101010010010010011100111001000000000001000100000000 


which has dimension 12, with 


AG9(z) = (1+ 27%) +3 x (z? -- 28) 11 x (а + 2) + 
20 x (z!8 + 2°8) +51 x (220 + 29) +56 x (222 +z”) + 
111 x (24 + 222) + 164 x (276 + 29) + 187 x (28 + 28) + (9.35) 
224 x (220 + 2“) + 294 x (232 + 244) + 328 x (24427) + 
366 x (2°° + 240) + 464 x z” 


respectively. Consider the number of codewords of weight 12, from (9.31)—(9.35), 
we know that A13(G9) = 2] and A15 (G4) = 3; applying (9.28), 


Ар(5) 23x21 —2x 3 (mod 4)=1 (mod 4) 
and thus, we have the following set of simultaneous congruences: 


Aj2(S2) = 1 (mod 22) 
Ар(53) = 3 (mod 3?) 
А2(519) = 0 (mod 19) 
Ар(8з) = 0 (mod 37). 


Following ће Chinese remainder theorem, a solution to the above congruences, 
denoted by A15 (.27^), is congruent modulo LCM(2?, 32,19, 37}, where LCM{2?, 37, 19, 
37} is the least common multiple of the moduli 22, 32, 19 and 37, which is equal to 
22 x 32 x 19 x 37 = 25308 in this case. Since these moduli are pairwise coprime, 
by the extended Euclidean algorithm, we can write 
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25308 
1= 4 х 1582+ ——— x CD 


ee 


1 29x 625 + —— 
Ы 9 


25308 
Le SERA х (9) 


1=37~x 


25308 


37 + 22 
TU OU 


A solution to the congruences above is given by 


Ар Ж-іх IZ 


= 2109 


F3 


zx] 
+ 


25308 


0 x [aa 


— 1x 6327 + —6 х 2812 
(mod 25308) 


= 25308л12 + 2109. 


х (—2) 


(=>). 


3 x (вә = +0 


| (mod 25308) 


(mod 25308) 
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25308 
[o] 


Referring to the weight enumerator function, (9.31), we can immediately see that 
пр = 0, indicating that А |; has been accurately evaluated. Repeating the above pro- 
cedures for weights larger than 12, we have Table9.3 which shows that the weight 
distributions of 437 are indeed accurate. In fact, since the complete weight distrib- 


Table 9.3 Modular congruence weight distributions of 237 


ifn—i 


0/76 
12/64 
16/60 
18/58 
20/56 
22/54 
24/52 
26/50 
28/48 
30/46 
32/44 
34/42 
36/40 
38 


Ai(S2) 
mod 22 


on CoC о OF © ошо со оошсо H m ые 


Aj(S3) 
mod 32 


шо з © © осо л © © л с OA We 


Ai(Si9) 
mod 19 
1 


Юю © © Со о © О о © с со єс 


Ai (S37) 
mod 37 
1 


0 
0 
0 
0 
0 
0 
0 
0 
0 
0 
0 
0 
2 


А ӨФӨ) 
mod 25308 
1 

2109 
10545 
0 
23199 
22496 
6327 
0 
16169 
5624 


ni in 


Aj = 25308n; + Aj (2€) 


295 
2116 
10886 
44014 
143278 
371614 
774865 
1306604 
1785996 
1981878 
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utions can be obtained once the first few terms required by Gleason's theorem are 
known, verification of these few terms is sufficient. 


Example 9.2 Gulliver et al. [6] have shown that the (168, 84, 24) doubly even self- 
dual quadratic double-circulant code беҙ is not extremal since it has minimum 
distance less than or equal to 28. The weight enumerator of a Type-II code of length 
n is given by Gleason's theorem, which is expressed as [15] 


[n/24] 
A(z) = >, Kia + 1424 + 28) 83100401 zy, (9.36) 
i=0 


where K; are some integers. As shown by (9.36), only the first few terms of A; are 
required in order to completely determine the weight distribution of a Type-II code. 
For з, only the first eight terms of A; are required. Using the parallel version 
of the efficient codeword enumeration method described in Chap.5, Sect.9.5, we 
determined that all of these eight terms аге 0 apart from Ag = 1, A»4 = 571704 апа 
Aog = 17008194. 

We need to verify independently whether or not A24 and Ag have been correctly 
evaluated. As in the previous example, the modular congruence method can be used 
for this purpose. For p = 83, we have | Ж| = 2? x 3 x 7 x 41 x 83 = 285852. We 
will consider the odd prime cases in the first place. 

For prime g = 3, a cyclic group of order 3, $3 can be generated by Е 1] € 
Р51.2(83), and we found that the subcode invariant under $5 has dimension 28 and 
has 63 and 0 codewords of weights 24 and 28, respectively. 

For prime q — 7, we have [3 b] which generates 57. The subcode fixed by 5$; 
has dimension 12 and no codewords of weight 24 or 28 are contained in this subcode. 

Similarly, for prime q = 41, the subcode fixed by 541, which is generated by 
[3 11 and has dimension 4, contains no codewords of weight 24 or 28. 

Finally, for prime 4 = 83, the invariant subcode of dimension 2 contains the all- 
zeros, the all-ones, (0,0,...,0,0, 1, 1,..., 1, 1 and (1, 1,..., 1, 1,0, 0,..., 0, 0} 

——— ——— ——— ——— 
84 84 84 84 
codewords only. The cyclic group Ss; is generated by [43 ai I: 


For the case of q — 2, we have P — BA and T = Ei tL The subcode fixed 
by S5, which has dimension 42, contains 196 and 1050 codewords of weights 24 
and 28, respectively. Meanwhile, the subcode fixed by G4, which has dimension 22, 
contains 4 and 6 codewords of weights 24 and 28, respectively. 

Thus, using (9.28), the numbers of codewords of weights 24 and 28 fixed by S2 
are 


А24(5) = 3 x 196-2 х4=0 (mod 4), and 
Azg(S2) = 3 x 1050-2 x 6=2 (mod 4) 
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and by applying the Chinese remainder theorem to all A;(S,) for i = 24, 28, we 
arrive at 


Arg = под х 285852 (9.37а) 
апа 
Aog = nag х 285852 + 142926. (9.37) 


From (9.37) we have now verified A24 and Аҙҙ, since they have equality for non- 
negative integers n24 and nog (n24 = 2 and nog = 59). Using Gleason's theorem, 
i.e. (9.36), the weight enumerator function of the (168, 84, 24) code ££s4 is obtained 
and it is given by 


A(z) = (z? + 2188) 
571704 x (224 + 214)+ 
17008194 х (228 + 219). 
5507510484 x (222 + 2136) 
1252615755636 х (226 + 2!32)4- 
166058829151929 x (29 + 212%) 
13047194638256310 x (z^ + 212) 
629048483051034984 x (24% + 2120)-+ 
19087129808556586056 х (22 + z!!6)+ (9.38) 
372099697089030108600 х (2° + 2!12)+ 
4739291490433882602066 х (2% + 2195. 
39973673426117369814414 х (26 + 219*)-+ 
225696677517789500207052 x (28 + 2199). 
860241109321000217491044 х (27? + 2°%)+ 
2227390682939806465038006 х (276 + 2°2)+ 
3935099587279668544910376 х (280 + 285). 
4755747411704650343205104 х :%. 


For the complete weight distributions and their congruences of the (2(p + 1), 
p + 1, d) quadratic double-circulant codes, for 11 < p < 83, except р = 37 as it 
has already been given in Example 9.1, refer to Appendix Weight Distributions of 
Quadratic Double-Circulant Codes and their Modulo Congruence". 
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9.6.2 The Number of Codewords of a Given Weight 
in Extended Quadratic Residue Codes 


We have modified the modular congruence approach of Mykkeltveit et al. [14], which 
was originally introduced for extended QR codes 2 , 50 that it is applicable to the 
quadratic double-circulant codes. Whilst 4, contains one non-cyclic subgroup of 
order 4, 2, contains two distinct non-cyclic subgroups of this order, namely G? and 
G}. As a consequence, (9.28) becomes 


Aj(S2) = Q" + 1)A;(H5) — 2" ! A; (GY) — 2"  Aj(Gl) (mod 2"+!), (9.39) 


where 2”+! is the highest power of 2 that divides |. |. Unlike Z p» Where there are 
two circulants in which each one is fixed by Р51 (р), a linear group PSL2(p) acts on 
the entire coordinates of ro In order to obtain the invariant subcode, we only need 
a set of linear equations containing the parity-check matrix of Ф„, which is arranged 
in (0, 1,..., p — 2, p — 1) (oo) order, and c; + c; = 0 for all i € Е, U {oo}. Note 
that с; and c; are defined in the same manner as in Sect. 9.6.1. 

We demonstrate the importance of this modular congruence approach by proving 
that the published results for the weight distributions of Asi and ёз are incorrect. 


However, first let us derive the weight distribution of „вт. 


Example 9.3 Тһеге exists an extended QR code вл which has identical parameters 
(n = 168, К = 84 and d = 24) as the code аҙ. Since Lg can be put into double- 
circulant form and it is Туре-П self-dual, the algorithm in бесі. 9.5 сап be used to 
compute the number of codewords of weights 24 and 28, denoted by A5, and A}, for 
convenience, from which we can use Gleason's theorem (9.36) to derive the weight 
enumerator function of the code, A'(z). By codeword enumeration using multiple 
computers we found that 


A^, = 776216 


/ (9.40) 
Ag = 18130188. 
In order to verify the accuracy of A5, and A5,, the modular congruence method 


is used. In this case, we have Aut( Ae) 2 2 Jf = PSL2(167). We also know that 
[PSL2(167)) = 2? x 3x 7x 83 x 167 = 2328648. Let Р = [22 is] and T — 


|? 1561, 


Let the поо of orders 3, 7, 83 and 167 be generated by [10 166 r]; [ {бет ! 
| ids 1] and Lie 166 ies]: respectively. The numbers of codewords of weights 24 and 28 
in the various invariant subcodes of dimension Ё are 


H c? б} 53 57 583 5167 
k 42 22 21 28 12 2 1 
A24 252 6 4 140 0 0 0 
Aog 1812 36 0 0 6 0 0 
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For La, equation (9.39) becomes 
А(%)-5хА(Н)-2х А(69-2х Aj(Gl) (mod 8). (9.41) 
It follows that 


Аз4(52) = 0 (mod 8) 
Aog(S2) = 4 (mod 8) 


and thus, 

Аз = под x 2328648 + 776216 (9.42a) 
and 

Abg = hg x 2328648 + 1829652 (9.42b) 


from the Chinese remainder theorem. . 

From (9.372) and (9.42a), we can see that 4s; and 4 are indeed inequivalent. 
This is because for integers "24,72, > 0, A24 Æ Ady. 

Comparing Ед. (9.40) with (9.42a) and (9.42b) establishes that A, = 776216 
(n5, = 0) and А”, = 18130188 (n5, = 7). The weight enumerator of Ag is derived 
from (9.36) and it is given in (9.43). In comparison to (9.38), it may be seen that 
Le is a slightly inferior code than з having more codewords of weights 24, 28 
and 32. 


A'(z) 2 (28 + 2168) 4 
716216 x (224 + 214)+ 
18130188 х (228 + z1^9.- 
5550332508 х (222 + 2136)-- 
1251282702264 x (226 + 2!32)+ 
166071600559137 х (z^? + :!?%)++ 
13047136918828740 x (z^ + z!4)4 
629048543890724216 x (z^5 + 2120)+ 
19087130695796615088 x (z?? + z!!6).- 
372099690249351071112 x (256 + 2!12)+ 
4739291519495550245228 x (z99 + 7108). 
39973673337590380474086 x (26 + z19^)4- 
225696677727188690570184 x (2° + 2109). 
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860241108921860741947676 x (272 + z26)4- 
2221390683565491780127428 x («7% + 2°2)-++ 
3935099586463594172460648 x (280 + z88)+ 
4755747412595715344169376 х 5. 


(9.43) 


Example 9.4 Gaborit et al. [4] gave А›;, for 22 < 2i < 32, of Sy and we will 
check the consistency of the published results. For p = 137, we have |PSL2(137)| = 
25 x 3 x 17 x 23 x 137 = 1285608 and we need to compute A5; (5), where 22 < 
2i < 32, for all primes q dividing |PSL2(137)|. Let P = [ 275! | and T = [126]. 

Let [ 1961]. [1%] and |161 | be generators of permutation of orders 3, 17 and 
23, respectively. It is not necessary to find a generator of permutation of order 137 
as it fixes the all-zeros and all-ones codewords only. Subcodes that are invariant 
under G$, G9, G}, $5, $1; and S23 are obtained and the number of weight i, for 
22 < 2i < 32, codewords in these subcodes is then computed. The results are shown 
as follows, where k denotes the dimension of the corresponding subcode, 


Н; G? Gi 53 Si7 S53 S137 

k 35 19 18 23 5 3 1 
An 170 6 6 0 0 0 0 
Ar 612 10 18 46 0 0 0 
Аж 1666 36 6 0 0 0 0 
Aog 8194 36 60 0 0 0 0 
A30 34816 126 22 943 0 0 0 
Аз 114563 261 189 0 0 0 0 


We have 
Ai(85) = 5 x Aji(H5) – 2 х А: (С) -2х Aj(G4) (mod 8), 


for 21595 which is identical to that for вт since they both have 23 as the highest 
power of 2 that divides |. |. Using this formulation, we obtain 


A2($2) =2 (mod 8) 
Ao4($5) =4 (mod 8) 
A2(S2) = 6 (mod 8) 
A2g($2) =2 (mod 8) 
Азо(52) = 0 (mod 8) 
Аз2 (55) = 3 (mod 8) 


and combining all the results using the Chinese remainder theorem, we arrive at 
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Ano = n» x 1285608 + 321402 
Аз = под x 1285608 + 1071340 
А = nos x 1285608 + 964206 
Aog = nos x 1285608 + 321402 
A30 = пзу х 1285608 + 428536 
A32 = пә x 1285608 + 1124907 


(9.44) 


for some non-negative integers п;. Comparing these to the results in [4], we can 
immediately see that n22 = 0, под = 1, nog = 16, nog = 381, and both A3, and A32 
were incorrectly reported. By codeword enumeration using multiple computers in 
parallel, we have determined that 


A30 = 6648307504 
Аз = 77865259035 


hence, referring to (9.44) it is found that изо = 5171 and n32 = 60566. 


Example 9.5  Gaborit et al. [4] also published the weight distribution of Ps and 


we will show that this has also been incorrectly reported. For dias |PSL2(151)| = 
23 х3 x 52 х 19 х 151 = 1721400 and we have P = [4] and Т = Б 100], 


Let [ 195 1 ]. [12% 4 | and [ 21 | be generators of permutation of orders 3, 5 and 19, 
respectively. The numbers of weight i codewords for i = 20 and 24, in the various 
fixed subcodes of dimension К, are 


A G? Gi 53 55 S19 S15 
k 38 20 19 26 16 4 1 
А 38 2 0 25 15 0 0 
А» 266 4 4 100 0 0 0 


апа А;(52) is again the same as that for primes 167 and 137, see (9.41). Using this 
equation, we have A5»9($5) = А24(5) = 2 (mod 8). Following the Chinese remain- 
der theorem, we obtain 


Ax = n29 x 1721400 + 28690 


. (9.45) 
A24 = под x 1721400 + 717250 


It follows that A»o is correctly reported in [4], but A24 is incorrectly reported as 
717230. Using the method in Sect. 9.5 implemented on multiple computers, we have 
determined that 


A2 = 28690 
Asa = 717250, 
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hence 7159 = 0 and под = 0 in (9.45). Since Azo and Азд are required to derive the 
complete weight distribution of Ês according to Gleason’s theorem for Туре-П 
codes (9.36), the weight distribution of Fai given in [4] is not correct. The correct 
weight distribution of this code, given in terms of the weight enumerator function, is 


A(z) = (2° +z”) + 
28690 х (220 + 2?) + 
717250 x (22* + 212%) + 
164250250 х (22% + z!”) + 
39390351505 x (222 + 2120) + 
5498418962110 х (226 + 2116) + 
430930711621830 x (229 + z!?) + 
19714914846904500 х (z^^ + 21%) + 
542987434093298550 х (2% + 219^) + 
9222363801696269658 х (2°? + 219) + 
98458872937331749615 х (226 + 2°%) + 
670740325520798111830 x (29 + 2°) + 
2949674479653615754525 x (2% + 288) + 
8446025592483506824150 х (2° + 2“) + 
15840564760239238232420 x (27 + z9?) + 
19527364659006697265368 x 276. 


(9.46) 


97 Minimum Distance Evaluation: А Probabilistic 
Approach 


An interesting observation is that the minimum weight codewords of 0, for p = +1 
(mod 8), апа 2,, for p = +3 (mod 8) аге always contained іп one or more of their 
fixed subcodes. At least, this is true for all known cases (n < 200) and this is depicted 
in Table 9.4. We can see that the subcode fixed by ИН» appears in all the known cases. 
In Table 9.4, the column dy denotes the minimum distance upper bound of extremal 
doubly even self-dual codes of a given length and the last column indicates the 
various subgroups whose fixed subcodes contain the minimum weight codewords. 
The highest п, for which the minimum distance of extended QR codes is known, 
is 168 [5] and we provide further results for n — 192, 194, and 200. We obtained 
the minimum distance of these extended QR codes using the parallel version of the 
minimum distance algorithm for cyclic codes (QR codes are cyclic) described in 
Chap. 5, Sect. 5.4. Note that the fact that the code is singly even (n — 194) or doubly 
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Table 9.4 Тһе minimum distance of 2, and Z, for 12 < n < 200 


n p p mod 8 d dy Subgroups 
12 5 -3 4 H, G4 

18 17 1 6 Н», G9, S3 
24 23 -1 8 8 Ay, G9, G} 
28 13 -3 6 Н, G4, 53 
32 31 -1 8 8 Н», G4, 53 
40 19 3 8 8 Н», G4, 53 
42 41 1 10 Hp, G4, Ss 
48 47 -1 12 12 Hp, G}, Ss 
60 29 -3 12 Нә, 53 

72 71 -1 12 16 Ho, Gl, S3, Ss 
74 73 1 l4 Н, 69, Gl, 8; 
76 27 —3 12 Ho, G4, $3 
80 79 -1 16 16 A, G9, С), 53 
88 43 3 16 16 Ho, $3, 87 
90 89 1 18 A, G9, С), 5з 
98 97 1 16 н, GY 
104 103 -1 20 20 Н>, 69,5 
108 53 -3 20 Н>, G4 
1142 113 1 16 Н», Gl. $; 
120 59 3 20 24 Ho, Ga, Ss 
124 61 -3 20 Нэ, Ga, $3, 55 
128 127 -1 20 24 Н», $3 

136 67 3 24 24 Ho, Ga, $3, 81 
138 137 1 22 A, G9, G} 
1525 151 -1 20 28 Hp, 60,5, Ss 
168 167 -1 24 32 A, G9, G}, 5з 
168 83 3 24 32 Ho, Ga, 53 
192 191 -1 28 36 Н, G} 
194 193 1 28 Н», С}, 53 
200 199 -1 32 36 A, G9, С), 5з 


* Extended duadic code [12] has higher minimum distance 


even (n — 192, 200) is also taken into account in order to reduce the number of 
codewords that need to be enumerated, see Chap. 5, Sects. 5.2.3 and 5.4. This code 
property is also taken into account for computing the minimum distance of ZZ, using 
the method described in Sect. 9.5. 

Based on the above observation, a probabilistic approach to minimum distance 
evaluation is developed. Given Ê, or 2, the minimum distance of the code is upper 
bounded by 


d < min {d(Z)}, (9.47) 
2-(69,0%,61,81,84.2-) 


246 


9 Algebraic Quasi Cyclic Codes 


Table 9.5 The minimum distance of 2, and Z, for 204 < n < 450 


224 
2348 
240° 
242» 
258^ 
264^ 
264^ 
272b 
280^ 
282^ 
300° 
312^ 
314^ 
316^ 
328^ 
338^ 
348^ 
354^ 
360^ 
360° 
364° 
368° 
384^ 
396^ 
402° 
410° 
424° 
432° 
434° 
440° 
450° 


449 


p mod 8 
—3 


3 
2] 
1 
—1 
1 


а 
< 24 
< 24 
< 30 
< 32 
< 26 
< 32 


< 48 
< 56 
< 48 
< 38 
< 48 
< 56 


du 


40 


40 


44 


48 


48 


48 
48 


56 


56 


64 
64 


64 
68 


72 
76 


76 


Subgroups 
Ho, G4, 55 
Ab, Сд, $3 
Hn, $3 
Н, GY, Gl 
Нэ, 5із 
Н», С, 
Н, С}, S3, Ss 
Н», С, 
Н», 62,8 
H2, G4 
Hp, 69, Gl, 55 
Нә, 53 
Н, G4, С), 5з 
Н», G4 
A, 62,8 
Н», G}, $3 
A, $3 
Ho, G4 
Н», Gl. 53 
Нә, 53 
Fh, G} 
Н, G9, Gh, 25 
Ho, G4, 25 
Ab, G4, Za 
Н», 69,23, 
Н, G4, 73 
Њ, 21 
Н, GY, Gh, Zs 
Ho, G4, Z3 
Н, G4, Z3, Z7 
Н, GY, GL, Z3 
Ho, G4, Z3 
Н, G4, GL, 73 
Н», С, 


* Extended duadic code [12] has higher minimum distance 


>The minimum distance of the subcode is computed probabilistically 


where d(Z) is the minimum distance of the subcode fixed by 7 е PSL2(p) and q 
runs through all odd primes that divide |PSL2(p)|. Note that for Z,, С? = С! һепсе, 
only one is required. Using (9.47), we give an upper bound of ће minimum distance 
of 2, and Z, for all codes where n < 450 and this is tabulated in Table 9.5. The 
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Fig. 9.1 Minimum distance and the extremal bound for distance of doubly even self-dual codes 


various fixed subgroups where the minimum weight codewords are found are given 
in the last column of this table. As shown in Tables 9.4 and 9.5, there is no extremal 
extended QR or quadratic double-circulant codes for 136 < n < 450 and we plot the 
minimum distance (or its upper bound for n > 200) against the extremal bound in 
Fig.9.1. From this figure, it is obvious that, as the block length increases, the gap 
between the extremal bound and the minimum distance widens and it seems that 
longer block lengths will follow the same trend. Thus, we conjecture that п = 136 is 
the longest doubly even extremal self-dual double-circulant code. It is worth noting 
that, for extended QR codes, the results obtained using this probabilistic method are 
the same as those published by Leon [11]. 


9.8 Conclusions 


Bordered double-circulant codes based on primes can be classified into two classes: 
(p + 1, (p + 1/2, d) extended QR codes, for primes +1 (mod 8), and (2(p + 
1), p + 1, d) quadratic double-circulant codes, for primes +3 (mod 8). 


Whilst quadratic double-circulant codes always exist, given a prime p = +3 
(mod 8), bordered double-circulant codes may not exist given a prime p = +1 
(mod 8). 

There always exist (2p, p, d) pure double-circulant codes for any prime p = +3 


(mod 8). 
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For primes p = —1,3 (mod 8), the double-circulant codes are self-dual and for 
other primes, the double-circulant codes are formally self-dual. 

By exploiting the code structure of formally self-dual, double-circulant codes for 
р = —3 (mod 8) and also the self-dual double-circulant codes for both pure and 
bordered cases, we have shown that, compared to the standard method of evaluation, 
the number of codewords required to evaluate the minimum distance or to count the 
number of codewords of a given weight can be reduced by a factor of 2. 

The automorphism group of the (p 4- 1, (p 4- 1)/2, d) extended QR code contains 
the projective special linear group Р51 (р) acting on the coordinates (оо)(0,1,..., 
р-=2,р- 1). 

The automorphism group of ће (2(p + 1), р + 1, d) quadratic double-circulant 
code contains PSL2(p), acting on coordinates (00)(0, 1,..., p — 2, p — 1), applied 
simultaneously to left and right circulants. 

The number of codewords of weight i of prime-based double-circulant codes, 
denoted by А;, can be written as A; =n; x |PSL2(p)| + Aj(PSLo(p)) = 
А;(Р512(р)) (mod |PSL2(p)|) where A;(PSL2(p)) denotes the number of code- 
words of weight i that are fixed by some element of PSL2(p). This result was due 
to Mykkeltveit et al. [14] and was originally introduced for extended QR codes. We 
have shown in this chapter that, with some modifications, this modulo congruence 
method can also be applied to quadratic double-circulant codes. 


The modulo congruence technique is found to be very useful in verifying the 
number of codewords of a given weight obtained exhaustively by computation. We 
have shown the usefulness of this method by providing corrections to mistakes in 
previously published results of the weight distributions of extended QR codes for 
primes 137 and 151. 

The weight distribution of the (168, 84, 24) extended QR code, which was previ- 
ously unknown, has been evaluated and presented above. There also exists a quadratic 
double-circulant code with identical parameters (n, k and d) and the weight dis- 
tribution of this code has also been presented above. The (168, 84, 24) quadratic 
double-circulant code is a better code than the (168, 84, 24) extended QR code since 
it has less low-weight codewords. The usefulness of the modulo congruence method 
in checking weight distribution results has been demonstrated in verifying the cor- 
rectness of the weight distributions of these two codes. 

The weight enumerator polynomial of an extended QR code of prime p, denoted 
by А (z), can be obtained using Gleason's theorem once the first few terms are 
known. Since PSL2(p) is doubly transitive [13], knowing A (z) implies А z(z), 
the weight enumerator polynomial of the corresponding cyclic QR code, is also 
known, i.e. 
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where A (z) is the first derivative of A 2(2) with the respect to z [19]. As a con- 
sequence, we have been able to evaluate the weight distributions of the QR codes 
for primes 151 and 167. These are tabulated in Appendix “Weight Distributions of 
Quadratic Residues Codes for Primes 151 and 167", Tables9.19 and 9.20, respec- 
tively. 


A new probabilistic method to obtain the minimum distance of double-circulant 
codes based on primes has been described. This probabilistic approach is based on the 
observation that the minimum weight codewords are always contained in one or more 
subcodes fixed by some element of PSL2(p). Using this approach, we conjecture that 
there are no extremal double-circulant self-dual codes longer than 136 and that this 
is the last extremal code to be found. 


9.9 Summary 


In this chapter, self-dual and binary double-circulant codes based on primes have 
been described in detail. These binary codes are some of the most powerful codes 
known and as such form an important class of codes due to their powerful error- 
correcting capabilities and their rich mathematical structure. This structure enables 
the entire weight distribution of a code to be determined. With these properties, 
this family of codes has been a subject of extensive research for many years. For 
these codes that are longer than around 150 bits, an accurate determination of the 
codeword weight distributions has been an unsolved challenge. We have shown that 
the code structure may be used in a new algorithm that requires less codewords to 
be enumerated than traditional methods. As a consequence we have presented new 
weight distribution results for codes of length 152, 168, 192, 194 and 200. We have 
shown how a modular congruence method can be used to check weight distributions 
and have corrected some mistakes in previously published results for codes of lengths 
137 and 151. For evaluation of the minimum Hamming distance for very long codes 
a new probabilistic method has been presented along with results for codes up to 
450 bits long. It is conjectured that the (136, 68, 24) self-dual code is the longest 
extremal code, meeting the upper bound for minimum Hamming distance, and no 
other, longer, extremal code exists. 


Appendix 
Circulant Analysis p — 11 


See Tables 9.6, 9.7 and 9.8. 
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Table 9.8 Circulant analysis p = 11, j(x) = | +x 4- x^ +x 4 x^ x? d x? x! 4 x?4 
x? +x! factors of 1 + x? 

i Јо) 

1 0, 1, 2, 3, 4, 5, 6, 7, 8,9, 10 


Weight Distributions of Quadratic Double-Circulant Codes 
and their Modulo Congruence 


Primes +3 Modulo 8 


Prime 11 


We have P = [15] and T = [9 0], Р,Т є PSL;(11), and the permutations of 
order 3, 5 and 11 are generated by E? nt } Е 10 1] and [4 10 1]. respectively. In addition, 
PSL,(11) = 22.3.5. 11. = 660 


and the weight enumerator polynomials of the invariant subcodes are 


АФ (о) = (1424) +15. (08 +216) +322 
AG (0) = (1+ 22) + "e + 216) 4-8. z” 
АЎ (2) = (1+ 22*) + 14.2? 

AS, (2) = (19 25) + е + 216) +6. z” 
Ай (0) = (1+ 22) 4-2. z? 


The weight distributions of %4; and their modular congruence аге shown in Table 9.9. 


Table 9.9 Modular congruence weight distributions of 211 


i Aj(S2) Aj(S3) Aj (Ss) Ai (S11) Ai (2) nj? А; 
mod 22 mod 3 mod 5 mod 11 mod 660 

0 1 1 1 1 1 0 1 

8 3 0 4 0 99 1 759 

12 0 2 1 2 596 3 2576 

16 3 0 4 0 99 1 759 

24 1 1 1 1 1 0 1 
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Prime 19 


We have P — E 6 ] and T = [ 9] P,T € PSL5(19), and the permutations of 
0 


0 
1 
order 3, 5 and 19 аге generated by [ 181 3 Е 18 i] and [4 18 i]: respectively. In addition, 
PSL2(19) = 22.32.5. 19. = 3420 


and the weight enumerator polynomials of the invariant subcodes are 


0 
шь © = (1229) +5. (28 29) +во. (212 29) +250. (216 + 29) 352. 2? 
А (г у= (1+ 2“ VES (а-а) +8. (22 +2) +14. (252) 4-16. 2? 
AG (2) = (1-929) +6 e +?) +22. (2? e 28) +57. (26 2%) + 84-2 


AG (2) 


AD (©) = (1+: = z 
Bay ( = ( 


1+ 290) 42-2 z 


The weight distributions of 219 and their modular congruence are shown іп 
Table 9.10. 


Prime 43 


We have Р = [1,15 | and T = [22], P, T € PSL2(43), and the permutations of 
order 3, 7, 11 and 43 are generated by ЕЕ 1], В i]. [5 11 апа E: A] respectively. 
In addition, 


PSL; (43) = 22.3.7. 11-43. = 39732 


Table 9.10 Modular congruence weight distributions of 219 
i Ai(82) Ai (83) Aj (55) Ai (S19) Ai (2E) пі? А; 
тоа 22 той 32 тоа 5 тоа 19 тоа 3420 


0 1 1 1 1 1 0 1 
8 1 6 0 0 285 0 285 
12 0 4 0 0 760 6 21280 
16 2 3 0 0 570 70 239970 
20 0 3 4 2 2244 153 525504 
24 2 3 0 0 570 70 239970 
28 0 4 0 0 760 6 21280 
32 1 6 0 0 285 0 285 
40 1 1 1 1 1 0 1 
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and the weight enumerator polynomials of the invariant subcodes are 


AGO (о = (1+ 85) +44. (216 427) + 1232. (29 + 268) + 10241 - (<4 + 45%) + 
54560. (228 + 260) + 198374 - (232 + 25°) + 491568. (26 + 232) + 
839916 - (240 + 248) + 1002432. 244 

AG? (© = (1+ 28) +32. (229 + 288) +тт. (2 +2) + 160. (278 + 2) + 
330. (222 + 256) + 480 - (236+ 222) + 616- (240 +248) + 704-244 

AG @) = (14 258) +7. (216 +2) + 168 - (229 +268) + 445. (24 + 24) + 
1960 - (228 + 260) + 4704. (232 + 256) + 7224. (236 + 5?) + 
10843. (<4 + 49) + 14832. z“ 

АФ) 2 (1 +288) +65 ш +2”) +16. (z^ + 2) didis (23 +2) + 
9. (> uu) +48. С" +?) 484. 244 

AGG) = (14258) 414-24 

AGBS) = (1+ 258) 42-24, 


The weight distributions of %43 and their modular congruence are shown іп 
Table 9.11. 


Prime 59 


We have P = [33] and T = [? | P,T  Р51.(59), and the permutations of 


23 58 
order 3, 5, 29 and 59 are generated by | $1]. [ 4 4], [$1] and [ & 2 |, respectively. 


In addition, 
Р51.:(59) = 22.3.5. 29. 59. = 102660 
апа the weight enumerator polynomials of the invariant subcodes аге 
0 
Age, () =(1 +2!) +90. (229 + 1%) + 2555. (z + 298) + 
32700. (228 + 2°) +278865. (222 + 29) + 1721810. (26 + 2) + 


7807800. (z^ n 8 -- 26366160 - и n 2% + 67152520 - (04 + z2”) E 


130171860 - (2° + i + 193193715. Gi + z) + 220285672 . 2 


271 


Weight Distributions of Quadratic Double-Circulant ... 


I 

VOICE 

СЕ80669 
SCOTELSES 
8РРРВЕЄС9ОТ 
OLVISLOCYSCC 
CS ISPLOGSSOVI 
96/Л1С<1<08<917 
Оғ7<770108966 
96/1С1<08<917 
С6157106<С<071 
OLVISLOCYSCC 
ВРРРВЕЄС9ОТ 
6091615<6 
80669 

ТСЕ 

І 

ү 


0 

0 

911 

ESPET 
186817 
E89EL9OS 
66191566 
61461701 
604110061 
61461701 
66/49/66 
E89ELOS 
186817 
ESPET 

9LI 

0 

0 


1 
viu 


I 
VOICE 
0 
69067 
p9ITE 
7158 
9/96 
88797 
(1886 
88797 
9/96 
7158 
vOICe 
690SC 
0 
vOICe 
I 
TELGE рош( АУ — ep pour (EFS) 'y 


ч е» O Ёк с> ЖЫШ ч ИШ ч» ИК ч» МЕ ч. ИШ ч» ШЕ с» ШЕ к» ШЫ ч» ИШ ч» ЖШ > Ж» йр 


І 
0 
0 
0 
0 
0 
0 
0 
€ 
0 
0 
0 
0 
0 
0 
0 
І 
І 


O © сч \о с \о © © О© \о с \о с © ж = 


І 
q pow (11ў)'+у pou (45)'у 


— Onn oon on oon He Oe н 


І 
g рош (£9) !v 


--әс-соачосоососсвс-- OO 


cc pou (7g)!y 


1 


е JO SUOTINGINSIP JYSIOM oouoniSuoo r[npo]N тү: AQEL 


272 9 Algebraic Quasi Cyclic Codes 


А6%(2 = (1 ge Рб. (a | а”) 19. (2% + 2%) +132. (<* +2) + 


2659 
393 . (232 + z) +878. (2% ЕЗ a) + 1848 - {2% + z) +3312. ee + 2%) + 


5192. (^ 4 z”) + 7308. (2% + i +8931. (2% + z“) + 9496. 250 


AG (г) = (1 qm) 285. fi + 2%) + 21280 - (2%6 ud n 


239970 - (248 + 272) + 525504 . 260 
AG C) = (1+ 120) + 12- (22 + 2190) +711 - (29 +280) + 2648 - 2 
А? (а) = (1 а) 4. (2 | 28) Ьб. 260 


AG? @) = (1 а) 2.2%. 


The weight distributions of 259 and their modular congruence are shown іп 
Table 9.12. 


Prime 67 


We have Р = [3,22] and T = [? | Р,Т € PSL;(67), and the permutations of 


20 66 
order 3, 11, 17 and 67 are generated by | & 1]. [ & b]; [ $1] and [ 25 |. respectively. 


In addition, 
Р5І2(67) = 22.3.11. 17 - 67. = 150348 
and the weight enumerator polynomials of the invariant subcodes are 


0 
AG? (2) = (1+ 2126) + 578 - (224 + 2112) + 14688. (228 + 2109) + 
173247 - (222 + 21%) + 1480768 - (23% + 2100) + 9551297. (240 + 2°) + 


46687712 - (24 + z9?) + 175068210 - (248 + 288) + 509510400 - (е + a) + 


1160576876 - (2% + ge + 2081112256 - (2% + 276) + 2949597087. (26 + 272) + 
3312322944 . 29 
АФ () = (1 ED 2136) 4-18. (22% T 2112) 4-88. (225 dk 219%) 4271: (232 + zi) $ 
816 - (226 + 2100) + 2001. (220 + 296) +4344 . (4 +z”) + 
8386 - (248 + 295) + 14144- (2°? + 2) +21260. (25° + 259) + 
28336 - (260 + 276) + 33599. (2% + 272) + 35616 . 2% 
AR O - (1 Xx є б) +66. (z^ zh gH + 682. (228 + gm + 3696 . (222 а gm) 4 
12390. (226 + 2190) + 54747. (z^? + 2) + 163680. (2 + 222) + 
318516 - (248 + 288) + 753522. (252 + 29^) + 1474704 - (255 + 299) + 
1763454. (260 + 276) + 2339502 . (2% + 272) + 3007296 . 268 
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AR (G3 = (1+ zP6) +6. (22^ + 2112) + 16. (26 + 219) +6. (24 +z”) + 
9. (28 + 288) +48. C + d 4.84. 268 
AGD j= (1 + 2136) +14. z88 


(S67) ка 136 68 
Ag, (z) =(1+°)+2. 


The weight distributions of Жоу and their modular congruence are shown іп 
Table 9.13. 


Prime 83 


We have Р-|12 | and T = [0€ ME T € PSL,(83), and the шна of 
order 3, 7, 41 and 83 are generated by | 21]. [8 b] [$1] and [ 22, respectively. 
In addition, 


PSL;(83) = 22.3. 7.41. 83. = 285852 


and the weight enumerator polynomials of the invariant subcodes are 


AG? (2) = (1 + а) + 196. (z^ + т”) + 1050. (с 28 +!) + 
29232 - (222 + 196) + 443156. (226 + 2182) + 
4866477 - (2! + 2128) + 42512190. (24 + 4) + 
292033644 - ( + 2120) + 1590338568 - (2° + 2116) + 
6952198884 - (5 + 212) + 24612232106 - (2 + 219%) + 


71013075210 - (6 + а) + 167850453036 - a + d + 


326369180312. (27 p 523672883454 - (27° + 292) + 


694880243820. (г аз) 763485528432. :% 
А69 EIU | 4”) 4. ү“ | а) +6: (2% | gh) | 


a6 (229) + 532. (25-29?) + ызт. (© + 21) 4 


3810. (“+ а) + 10572. (с 48 + a) + 24456. (2% + a) + 
50244. (25 3 z!) + 95030. (<® + ы + 158874. (с e$ a а) + 


241452. (+ gm + 337640. (2+ z") + 425442. (ге + e Ф 


489708 - (> + 28) + 515696 . 284 


275 


Weight Distributions of Quadratic Double-Circulant ... 


STEOST 


-— 


(a)y — " 


I 0 I 

068L66€ 9c Cr 888 
OctrVSSccI ELIS 91106 
SLLIELSS6CSI 180/101 L8SLE 
ОТОЎІРРТІ6Е8СӮТ 8950056 0899С1 
601/950086/8С19 8/71869/07 19/21 
07760866С%759/.6671 681<<6С</66 899С1 


O6SILETIGLOESIESIT 1866РСРРСЄРІ COS OT 
0009/605с6116706581 000С116968с<01 O 
7001с/26141801С67/6 <7579<80//1879 РРЄ6б0Т 
С<6697У5191661610916 #©©}5511//©С01С 0 
519611<90085/90(869 1910119996677С7 L8SLC 
0786/.586666 111750908 <819<809986096< 961861 
6196101<90086/9С(859 191119996677 L8SL€ 
С56697У5191.6С1620916 vccveSTILLCCOIC 0 
TOOICLCGILISCICSVLO <7579С<80//.1879 РРЄ6б0Т 
0009/60506116706581 000С116968с<01 O 
OO8ILECIGLOESIESTT 186677577С671 (00500 


077608662759/.6671 681656766 899с1 
601/950086/8С19 8/71869/07 19/21 
91071771668С71 ©89©00©6 0899t T 
SLLIELSS6CSI I80LICI L8SLE 
0С<7У88СС1 ELIS 91105 
068/.66< 9c ©7888 
І 0 І 

ү Vu 


е-е-ооооососососвасососоососоососоосооос- 


І 


е--ооооосососочосооосососоососоосооосо- 


І 


ооо ос озосог осочсососожшоч ОСО = 


І 


е-ээоооосососососоосососоососсоооос-с- 


І 


чоэәео-оэчооэовевсовососовсо- совсосі- 


9ЄТ 
сп 
801 
РОТ 
001 
96 
(6 
88 
v8 
08 
9L 
CL 
89 
v9 
09 
96 
TS 
8v 
ҮР 
07 
9t 
(43 
8c 


0 


вре0ст pour (27)'V 19 рош (/95)'у Ly pow (4Ig)!y ту рош (115)'у gpou(tg)'y z pow (65)/у — 1 


19% yo suonnqugsip JYSIOM oouoniguoo NPON ET'6 AQEL 


276 9 Algebraic Quasi Cyclic Codes 


ADD i= (1 de) 63. (zh 4%) +8568. (< 36 +) + 617085. G -а%) + 


11720352. (jo | 1” + 64866627 - (5? n 2% + 114010064 . 28 


AG, G = (1 zm) 159. (256 uud +2576 - 28 
AGD) = (1 a) 4. Са ; аз) r6. 284 


AG (2) = (1 ае) 2. 284, 


The weight distributions of 2з and their modular congruence are shown in 
Table 9.14. 


Primes —3 Modulo 8 


Prime 13 


We have P = E i] and T — [1% | Р,Те Р512(13), апа the permutations of 
order 3, 7 and 13 are generated by Е 1]. | 5 1] and [2 D |], respectively. In addition, 


PSL?(13) = 22.3. 7.13. = 1092 
and the weight enumerator polynomials of the invariant subcodes are 


G$ 28 
А2, (© = (! TE 


AY C = (14-25 


+26. (28 29) +32. (219 205) 37. (21? +218) +64. 28 
+10. (28 +290) +8. (2% +21) +5- (22 +216) +16: 14 
АЎ (© = (1 +778) 46. (d + 2”) +10- (2% +21) +9. (22 +216) тарағы 

E 


2.214 


ыы 


AZ © = (1+2 


ATP (0) = (1+2 ino 


The weight distributions of 4,3 and their modular congruence are shown іп 
Table 9.15. 

Prime 29 

We have P — p 15] and T — [0 21) P, T е PSL2(29), and the permutations of 
order 3, 5, 7 and 29 are generated by | $1]. [31]. [31] and [ & 4 |, respectively. 


In addition, 


PSL;(29) = 22.3.5.7.29. = 12180 
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Table 9.15 Modular congruence weight distributions of 413 
i Ai(82) Ai (53) Ai(87) Ai (S13) Ai(#) пі? Ai 
mod 2? mod 3 mod 7 mod 13 mod 1092 


0 1 1 1 1 1 0 1 
8 2 0 0 0 546 0 546 
10 0 1 0 0 364 1 1456 
12 1 0 0 0 273 3 3549 
14 0 0 2 2 912 4 5280 
16 1 0 0 0 273 3 3549 
18 0 1 0 0 364 1 1456 
20 2 0 0 0 546 0 546 
28 1 1 1 1 1 0 1 
ААС) 


aC 0) 
А20) = (1 + 260 )* 28. (zP + 248) +112- (4 +2‘) + 394. (2% +“) + 


1024. a 242 


7168. (226 + 234 

AGS @ = (1+ 60) +12. (z+ 
60. (ее | e 48. (2% | 2 + 60. (24 +2) +96- (25 - 24) + 
105. (28 + 222) + 136. 220 


AG» (с) = (1 10. (22 ud 70 (ее | dd | 245. (с^ ds £s +372. 230 


Фу 


E 

АС s e 15. (2% С) 32.2" 
9 
TE 


AG? ( ›=( 


Bry 
j (n 
AG? @ = (142) 2. 29 
The weight distributions of Ж and their modular congruence are shown іп 
Table 9.16. 
Prime 53 


We have Р = [51| and T = [9], P, T € 51-253), and the permutations of 


order 3, 13 and 53 are generated by | 21 ], [2 528 3l and [2 52 51 ae respectively. In addition, 


PSL, (53) = 22.35.13. 53. = 74412 
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Table 9.16 Modular congruence weight distributions of 4529 


i Ai(S2)  Ai($3)  Ai(Ss) А;(57)  Ai(S29) Ai ОФ) ni А; 
mod 22 mod 3 mod 5 mod7 10429 mod 12180 
0 1 1 1 1 1 1 0 1 
12 0 1 0 0 0 4060 0 4060 
14 0 0 0 0 0 0 2 24360 
16 2 0 0 6 0 2610 24 294930 
18 0 1 0 2 0 11020 141 1728400 
20 0 0 0 0 0 0 637 7758660 
22 0 0 0 1 0 3480 2162 26336640 
24 0 2 0 1 0 11600 5533 67403540 
26 0 0 0 0 0 О 10668 129936240 
28 1 0 0 1 0 6525 15843 192974265 
30 0 0 2 5 2 8412 18129 220819632 
32 1 0 0 1 0 6525 15843 192974265 
34 0 0 0 0 0 0 10668 129936240 
36 0 2 0 1 0 11600 5533 67403540 
38 0 0 0 1 0 3480 2162 26336640 
40 0 0 0 0 0 0 637 7758660 
42 0 1 0 2 0 11020 141 1728400 
44 2 0 0 6 0 2610 24 294930 
46 0 0 0 0 0 0 2 24360 
48 0 1 0 0 0 4060 0 4060 
60 1 1 1 1 1 1 0 1 
А-А (96) 


12180 


and the weight enumerator polynomials of the invariant subcodes are 


(G9) 


А, 


(G4) 
A gas 


(о) = (1 2108) +234. (229 + 288) + 1768. (222 + 286) + 5655. (224 + 24) + 
16328 - (220 + 28?) + 47335. (278 + 28°) + 127896 - (220 + 278) + 


316043 - (222 + 27°) + 705848 - (z?^ + 2^) + 1442883 - (26 + 272) + 
2728336 - (z*8 + 270) + 4786873 - (240 + 28) + 7768488. (222 + 266) + 


11636144. (24 + 2) + 16175848 - (210 + 202) + 20897565 - (2°® + 260) + 


25055576. (e? + e + 27976131 - (2 + z") + 29057552 . 25 


(2) = (1+ 2199) +12. (220 4 285) +12. (27 +2) +77. (7 +z") + 
108 - (276 + 282) + 243 . (228 + 280) + 296. (220 + 278) + 543. (232 +276) + 
612. jet Де z5) +1127. (е +?) + 1440. (2° NS ze) + 2037- (27 + 4%) E 
2636 - (222 + 266) + 3180. (24 + 2%) + 3672. (z^6 + 262) + 4289 (248 + 260) + 


4836 (250 + 25%) + 4875. (232 + 256) + 5544. 2 
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Table 9.17 Modular congruence weight distributions of 453 
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i 


88 
108 


Ai(S2) А;(53) Ai(Si3) А4(553) 


mod 22 mod 3? 


NOW © о © о» © о © єк эоэо- о«мэоэоэ-ооо- ооо о соо» сос осо кю eS 


1 


1 
0 
0 


= 
ев--с-эоэооососооосоосососососсоссо о 


— 
© oo 


18 


mod 13 mod 53 


на 
он ооооооюооооомоолооо о 


— Occ cc rnccocoococcoocococococ-— 


Һ.-ээээээээээээоэоээоозсзеоосоэсосоооосососососоосоосое- 


Ai (7€) 
mod 74412 
1 
37206 
0 
43407 
0 
64395 
64872 
18603 
0 
26871 
0 
67257 
11448 


11448 
67257 
0 
26871 
0 
18603 
64872 
64395 
0 
43407 
0 
37206 
1 


nj? 


3 

78 

1000 

10034 

91060 
658342 
3981207 
20237958 
86771673 
315441840 
976699540 
2584166840 
5859307669 
11412955404 
19133084721 
27645086470 
34462554487 
37087868793 
34462554487 
27645086470 
19133084721 
11412955404 
5859307669 
2584166840 
976699540 
315441840 
86771673 
20237958 
3981207 
658342. 
91060 

10034 

1000 

78 

3 


А; 


1 

260442 

5804136 

74455407 
746650008 
6776021115 
48988609776 
296249593887 
1505946930696 
6456853758147 
23472658198080 
72678166237737 
192293022909528 
436002802265628 
849260837522448 
1423731100290057 
2057126174405640 
2564427604488075 
2759782492680368 
2564427604488075 
2057126174405640 
1423731100290057 
849260837522448 
436002802265628 
192293022909528 
72678166237737 
23472658198080 
6456853758147 
1505946930696 
296249593887 
48988609776 
6776021115 
746650008 
74455407 
5804136 

260442 

1 


а " 


Ai—Ai (2€) 


74412 
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Table 9.18 Modular congruence weight distributions of 461 


і Aj (Sz) А;(83) А((55) А;(831) А; (861) Ai CI) ni? Ai 
mod2? mod3 mod5 mod31 mod61 mod 113460 
0 1 1 1 1 1 1 0 1 
20 0 0 3 0 0 90768 0 90768 
22 0 1 0 0 0 75640 4 529480 
24 2 2 0 0 0 94550 95 10873250 
26 0 2 4 0 0 83204 1508 171180884 
28 2 2 3 0 0 71858 19029 2159102198 
30 0 0 1 0 0 68076 199795 22668808776 
32 0 1 0 0 0 75640 1759003 199576556020 
34 0 0 3 0 0 90768 13123969 1489045613508 
36 2 0 3 0 0 34038 83433715 9466389337938 
38 0 1 1 0 0 30256 454337550 51549138453256 
40 0 2 0 0 0 37820 2128953815 241551099887720 
42 0 0 3 0 0 90768 8619600220 977979841051968 
44 0 0 2 0 0 22692 30259781792 3433274842143012 
46 0 2, 1 0 0 105896 92387524246 10482288501057056 
48 0 2 0 0 0 37820 245957173186 27906300869721380 
50 0 2 0 0 0 37820 572226179533 64924782329852000 
52 0 2 1 0 0 105896 1165598694540 132248827882614296 
54 0 2 3 0 0 15128 2081950370302 236218089014480048 
56 0 2 2 0 0 60512 3264875882211 370432817595720572 
58 0 2 2 0 0 60512 4499326496930 510493584341738312 
60 1 2 1 0 0 20801 5452574159887 618649064180799821 
62 0 2 1 2 2 102116 5813004046431 659543439108163376 
64 1 2 1 0 0 20801 5452574159887 618649064180799821 
66 0 2 2 0 0 60512 4499326496930 510493584341738312 
68 0 2 2 0 0 60512 3264875882211 370432817595720572 
70 0 2 3 0 0 15128 2081950370302 236218089014480048 
72 0 2 1 0 0 105896 1165598694540 132248827882614296 
74 0 2 0 0 0 37820 572226179533 64924782329852000 
76 0 2 0 0 0 37820 245957173186 27906300869721380 
78 0 2 1 0 0 105896 92387524246 10482288501057056 
80 0 0 2 0 0 22692 30259781792 3433274842143012 
82 0 0 3 0 0 90768 8619600220 977979841051968 
84 0 2 0 0 0 37820 2128953815 241551099887720 
86 0 1 1 0 0 30256 454337550 51549138453256 


(continued) 
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Table 9.18 (continued) 
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i Ai(52) Aj(S3) А;(55) Ai(S31) Ai (Sei) 
той 22 mod3 шо45 mod31 mod 61 mod 113460 


Aj(#) nj? Ai 


88 2 0 3 0 0 34038 83433715 9466389337938 
90 0 0 3 0 0 90768 13123969 1489045613508 
92 0 1 0 0 0 75640 1759003 199576556020 
94 0 0 1 0 0 68076 199795 220668808776 
96 2 2 3 0 0 71858 19029 2159102198 
98 0 2 4 0 0 83204 1508 171180884 
100 2 2 0 0 0 94550 95 10873250 
102 0 1 0 0 0 75640 4 529480 
104 0 0 3 0 0 90768 0 90768 
124 1 1 1 1 1 1 0 1 


а 


AS? (о) = (1+ 2108) +234. (24 + 28%) + 1962 - (220 + 278) + 9672. (226 + 27) + 
28728 - (z*? + 26) + 55629 . (248 + 260) + 69692. 254 


Ai — Ai (2€) 
113460 


AG? (z) = (1 + 2108) +6. (278 + 280) +2. (220 +z) +8. (20 + 268) + 


АЎ?) (а) — (1 + 2198) +2. 254. 


8. e? ES 2%) i (2° ES 2^) 412. 24 


The weight distributions of 253 and their modular congruence are shown in 


Table 9.17. 


Prime 61 


We have P — | 
order 3, 5, 31 and 61 are generated by 
In addition, 


2 19 
19 59 


] and T -| 


1 


0 
60 


PSL2(61) = 22.3.5.31.61. = 113460 


and the weight enumerator polynomials of the invariant subcodes are 


, P,T € PSL,(61), and the permutations of 
| [85] [2i] and [8 5), respectively. 
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А 


(Оў) _ 
Bo 
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(1-41) 4-208. СЫ 4- 400 - (22 + 2!) +1930. (24 +2!) + 


8180. (2° + 4%) + 26430 - po + z) + 84936 - (> an 4%) T: 


253572. (2 


Pu gu + 696468 - (et + z”) + 1725330. (256 + 2) ES 


3972240 - (2% + 4%) + 8585008. ie ES 2%) + 17159632. (4% + e, + 


31929532. (244 + 280) + 55569120. (36 + 278) + 90336940 - (24 + 276) + 


137329552. 
325698420. 
433616560. 


(220 + 2™) + 195328240. (292 + 272) + 260435936. (25 + 210) 


(226 + 268) + эв1вттово. (258 + 266) + 419856213 (% + 264) 
262 


AG? =(1 20) р 12. (22 | 29) 12. (224 z102) L36. (<> | 20) 


40. (226 + z”) +140. (2 + 4%) + 176. (2% + z”) +498. (с? + dd + 


(53) — 124 
Ад, = (1+: ) +30. 


576. (с> + 


z”) + 1340. (2% US z) +1580. (c? +2) + 2660. (2% M) Д. 


3432. (2 di 2) +4932. (z^ + gu) + 6368 - (z^ $ z”) + 8820. (4% + 2 + 
4 


10424. (c? 


18296 . (24 


200. (с + 
2416. i 
15340. (228 
68700 . (244 
177800. (z 

322070 - G 
399752. z6? 


АФ? = (1 ges) L3. (2° gi E24. (226 | dd + 48. (> | z) 


p ) 12752. (2° z”) 14536 - (<> + dd + 15840 - (2 af 4%) + 
265) + 18505. (260 + 2%) + 20192 2 
( 


20 +z!) +10. (ге + zi) 4 50. (<> + 219%) TR 


4 2 ) 4- 4992 . (^ +2) + 6945 . (24 +258 


50.4 274) + 201440 - (2°? + 272) + 225290. (25% +279 


) 
6 468) 301640. (58 266) 316706. (260 1 


z”) 620. (ze + 4%) +960. 7 + z”) F 
2 


МУ 


+ 
285) + 25085 - (79 + 284) + 34920. (z? +28) + 


80) 4.87548. (246 +278) + 104513. (248 +27) + 
7 


6. (> +z) +150. (e d 8. (с> | z”) + 168. (с i8) + 


96. (2° 


468. Gi + z?) +132. (2% З. 20) ES 


| z6) | 75. (a 54 


М 


656. (5 g 680 - (2? + 25) +300. [2% + z”) + 1386. (22 dE z”) д, 
198. [c 2m 1152. (2 + a) +1272. (ze + ge +301. (2% + e + 


2136. 262 


(531) 124 62 
Am -( < ) 27% 


(561) 124 62. 
Am = (1 5 ) =: 
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The weight distributions of 26 and their modular congruence are shown in 


Table 9.18. 


Weight Distributions of Quadratic Residues Codes for Primes 


151 and 167 


See Tables 9.19 and 9.20 


Table 9.19 Weight distributions of QR and extended QR codes of prime 151 


А; of [152, 76, 20] code 

1 

0 

28690 

0 

717250 

0 

164250250 

0 

39390351505 

0 

5498418962110 

0 

430930711621830 

0 

19714914846904500 

0 

542987434093298550 

0 

9222363801696269658 

0 

98458872937331749615 

0 
670740325520798111830 
0 
2949674479653615754525 
0 
8446025592483506824150 
0 
15840564760239238232420 
0 
19527364659006697265368 


а) of [151, 76, 19] code 

1 

3775 

24915 

113250 

604000 

30256625 

133993625 

8292705580 

31097645925 
1302257122605 
4196161839505 
113402818847850 
317527892773980 
5706949034630250 
14007965812274250 
171469716029462700 
371517718063835850 
3155019195317144883 
6067344606379124775 
36274321608490644595 
62184551328841105020 
264765917968736096775 
405974407552062015055 
1241968201959417159800 
1707706277694198594725 
3778485133479463579225 
4667540459004043244925 
7503425412744902320620 
8337139347494335911800 
9763682329503348632684 
9763682329503348632684 
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Table 9.20 Weight distributions of QR and extended QR codes of prime 167 


1 


0 
23 
24 
27 
28 
31 
32 
35 
36 
39 
40 
43 
44 
47 
48 
51 
52 
55 
56 
59 
60 
63 
64 
67 
68 
71 
72 
75 
76 
79 
80 
83 
84 


А; of [168, 84, 24] code 

1 

0 

776216 

0 

18130188 

0 

5550332508 

0 

1251282702264 

0 

166071600559137 

0 

13047136918828740 

0 

629048543890724216 

0 

19087130695796615088 

0 

372099690249351071112 

0 

4739291519495550245228 

0 
39973673337590380474086 
0 
225696677727188690570184 
0 
860241108921860741947676 
0 
2227390683565491780127428 
0 
3935099586463594172460648 
0 
4755747412595715344169376 


f; of (167, 84, 23] code 

1 

110888 

665328 

3021698 

15108490 

1057206192 

4493126316 

268132007628 
983150694636 
39540857275985 
126530743283152 
3417107288264670 
9630029630564070 
179728155397349776 
449320388493374440 
5907921405841809432 
13179209289954805656 
124033230083117023704 
248066460166234047408 
1692604114105553659010 
3046687405389996586218 
15228066033367763990128 
24745607304222616483958 
91353417175290660468884 
134343260551898030101300 
368674760966511746549004 
491566347955348995398672 
1007629118755817710057646 
1219761564809674070069782 
1873856945935044844028880 
2061242640528549328431768 
2377873706297857672084688 
2377873706297857672084688 
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Chapter 10 
Historical Convolutional Codes as Tail-Biting 
Block Codes 


10.1 Introduction 


In the late 1950s, a branch of error-correcting codes known as convolutional codes 
[1, 6, 11, 14] was explored almost independently of block codes and each discipline 
had their champions. For convolutional codes, sequential decoding was the norm and 
most of the literature on the subject was concerned with the performance of practical 
decoders and different decoding algorithms [2]. There were few publications on the 
theoretical analysis of convolutional codes. In contrast, there was a great deal of 
theory about linear, binary block codes and not a great deal about decoders, except 
for hard decision decoding of block codes. Soft decision decoding of block codes 
was considered to be quite impractical, except for trivial, very short codes. 

With Andrew Viterbi's invention [13] ofthe maximum likelihood decoder in 1967, 
featuring a trellis based decoder, an enormous impetus was given to convolutional 
codes and soft decision decoding. Interestingly, the algorithm itself, for solving the 
travelling saleman's problem [12], had been known since 1960. Consequently, inter- 
estin hard decision decoding of convolutional codes waned in favour of soft decision 
decoding. Correspondingly, block codes were suddenly out of fashion except for the 
ubiquitous Reed-Solomon codes. 

For sequential decoder applications, the convolutional codes used were systematic 
codes with one or more feedforward polynomials, whereas for applications using a 
Viterbi decoder, the convolutional codes were optimised for largest, minimum Ham- 
ming distance between codewords, d free, for a given memory (the highest degree of 
the generator polynomials defining the code). The result is always a non-systematic 
code. It should be noted that in the context of convolutional codes, the minimum 
Hamming distance between codewords is understood to be evaluated over the con- 
straint length, the memory of the code. This is traditionally called dmin. This is 
rather confusing when comparing the minimum Hamming distance of block codes 
with that of convolutional codes. A true comparison should compare the d free of a 
convolutional code to the dmin of a block code, for a given code rate. 
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Table 10.1 Best rate 1 convolutional codes designed for Viterbi decoding 


Memory Generator Polynomial rı (x) Generator Polynomial гә (x) d free 
2 1+х+х? 1--х2 5 
2 І+х+х2 +23 l+x+x3 6 
4 І+х +2 +2“ 1+5 + x4 7 
5 1-х--х2 H+ +5 14x24 х +25 8 
6 1--х 2 34x 1--х24-х3 4454 x 10 
7 І+х+х2 +5 хі 27 1 4x? + x5 4 x6 + x7 10 
8 І+х +2 +5 +5 ax 1 4x? + x5 4 x* 4 x8 12 


Since the early 1960s, a lot of work has been carried out on block codes and con- 
volutional codes for applications in deep space communications, primarily because 
providing a high signal-to-noise ratio is so expensive. Error-correcting codes allowed 
the signal to noise ratio to be reduced. 

The first coding arrangement implemented for space [6, 9] was part of the pay- 
load of Pioneer 9 which was launched into space in 1968. The payload featured a 
systematic, convolutional code designed by Lin and Lyne [7] with a d free of 12 and 
memory of 20. The generator polynomial is 


r(x) = Vx - x? x0 p x8 x8 p x9 а xP p xD el p x16, Up 418 х 4 20, 


This convolutional code was used with soft decision, sequential decoding featuring 
the Fano algorithm [2] to realise a coding gain of 3 dB. Interestingly, it was initially 
planned as a communications experiment and not envisaged to be used operationally 
to send telemetry data to Earth. However, its superior performance over the standard 
operational communications system which featured uncoded transmission meant that 
it was always used instead of the standard system. 

In 1969, the Mariner' 69 spacecraft was launched with a first order Reed-Muller 
(32, 6, 16) code [8] equivalent to the extended (32, 6, 16) cyclic code. A maximum 
likelihood correlation decoder was used. The coding gain was 2.2 dB [9]. 

By the mid 1970s, the standard for soft decision decoding on the AWGN channel 
notably applications for satellite communications and space communications was to 
use convolutional codes with Viterbi decoding, featuring the memory 7 code listed 
in Table 10.1. The generator polynomials are гү(х) = 1 +x + x? + x? + xÓ and 
r(x) = 1-2 x24 x? x? + x8 convolutional code, best known, in octal representation, 
as the (171, 133) code. The best half rate convolutional codes designed to be used 
with Viterbi decoding [1, 6] are tabulated in Table 10.1. 

The (171, 133) code with Viterbi soft decision decoding featured a coding gain 
of 5.1 dB at 10^? bit error rate which was around 2 dB better than its nearest rival 
featuring a high memory convolutional code and hard decision, sequential decoding. 
The (171, 133) convolutional code is one of the recommended NASA Planetary 
Standard Codes [3]. 
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However, more coding gain was achieved by concatenating the (171, 133) con- 
volutional code with a (255, 233) Reed-Solomon (RS) code which is able to correct 
16 symbol errors, each symbol being 8 bits. Quite a long interleaver needs to be 
used between the Viterbi decoder output and the RS decoder in order to break up the 
occasional error bursts which are output from the Viterbi decoder. Interleaver lengths 
vary from 4080 bits to 16320 bits and with the longest interleaver the coding gain of 
the concatenated arrangement is 7.25 dB, E = 2.35 dB at 10^? bit error rate), and 
itis a CCSDS [3] standard for space communications. 


10.2 Convolutional Codes and Circulant Block Codes 


It is straightforward to show that a double-circulant code is a half rate, tail-biting, 
feedforward convolutional code. Consider the Pioneer 9, half rate, convolutional 
code invented by Lin and Lyne [7] with generator polynomial 


r(x) 2 Pex 4x2 x Ех x8 x? x Pp x Зах х6 L4 418 419 1,20 


For a semi-infinite data sequence defined by d (x), the corresponding codeword, с(х), 
of the convolutional code consists of 


c(x) = d(x)|d(x)r(x) (10.1) 


where || represents interlacing of the data polynomial representing the data sequence 
and the parity polynomial representing the sequence of parity bits. 

The same generator polynomial can be used to define a block code of length 2n, 
a (2n, n) double-circulant code with a codeword consisting of 


с(х) = dx)|d Gr (x) modulo (1 + x^) (10.2) 


(Double-circulant codewords usually consist of one circulant followed by the second 
but it is clear that an equivalent code is obtained by interlacing the two circulants 
instead.) 

While comparing Eq. (10.1) with (10.2) as п — оо, it can be seen that the 
same codewords will be obtained. For finite п, it is apparent that the tail of the 
convolution of d(x) and r(x) will wrap around adding to the beginning as in a 
tail-biting convolutional code. It is also clear that if n is sufficiently long, only the 
Hamming weight of long convolutions, will be affected by the wrap around and 
these long convolution results will be of high Hamming weight anyway leading to 
the conclusion that if п is sufficiently long the dmin of the circulant code will be the 
same as the dfree of the convolutional code. Indeed, the low weight spectral terms 
of the two codes will be identical, as is borne out by codeword enumeration using 
the methods described in Chap. 5. 
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For the Pioneer 9 code, having a d free of 12, a double-circulant code with dmin 
also equal to 12 can be obtained with n as low as 34, producing a (68, 34, 12) code. 
It is noteworthy that this is not a very long code, particularly by modern standards. 

Codewords of the double-circulant code are given by 


c(x) —d(x)|d(x)(1 + x dig gg Rx pag g^ 
+ xl6 + xU + x18 +x + x”) modulo (1 + x?*) (10.3) 


As a double-circulant block code, this code can be soft decision decoded, with 
near maximum likelihood decoding using an extended Dorsch decoder, described 
in Chap. 15. The results for the AWGN channel are shown plotted in Fig. 10.1. Also 
plotted in Fig. 10.1 are the results obtained with the same convolutional code realised 
as a (120, 60, 12) double-circulant code which features less wrap around effects com- 
pared to the (68, 34, 12) code. 

Using the original sequential decoding with 8 level quantisation of the soft deci- 
sions realised a coding gain of 3 dB at a BER of 5 x 107^. Using the modified Dorsch 
decoder with this code can realise a coding gain of over 5 dB at a BER of 5 х 1074 
and over 6 dB at a BER of 1079 as is evident from Fig. 10.1. Moreover, there is 
no need for termination bits with the tail-biting arrangement. However, it should be 
noted that the state of the art, modified Dorsch decoder with soft decision decoding 
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Fig. 10.1 BER performance of the Pioneer 9 convolutional code encoded as a (68, 34, 12) or 
(120, 60, 12) double-circulant code with soft and hard decision, extended Dorsch decoding in 
comparison to uncoded QPSK 
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needs to evaluate up to 500,000 codewords per received vector for the (68, 34, 12) 
double-circulant code realisation and up to 1,000,000 codewords per received vector 
for the (120, 60, 12) double-circulant code version in order to achieve near maximum 
likelihood decoding. Figure 10.1 also shows the hard decision decoding performance 
realised with the modified, hard decision Dorsch decoder, also described in Chap. 15. 
The (120, 60, 12) double-circulant code version, has a degradation of 2.3 dB at 10-4 
BER compared to soft decision decoding, but still achieves a coding gain of 3.3 dB 
at 107^ BER. Similarly, the (68, 34, 12) double-circulant code version, has a degra- 
dation of 2.2 dB at 107^ BER compared to soft decision decoding, but still achieves 
a coding gain of 2.3 dB at 107^ BER. 

The conclusion to be drawn from Fig. 10.1 is that the Pioneer 9 coding system 
was limited not by the design of the code but by the design of the decoder. However 
to be fair, the cost of a Dorsch decoder would have been considered beyond reach 
back in 1967. 

Itis interesting to discuss the differences in performance between the (68, 34, 12) 
and (120, 60, 12) double-circulant code versions of the Pioneer 9 convolutional code. 
Both have a dmin of 12. However the number of weight 12 codewords, the multi- 
plicities of weight 12 codewords of the codes' weight distributions, is higher for the 
(68, 34, 12) double-circulant code version due to the wrap around of the second cir- 
culant which is only of length 34. The tails of the circulants of codewords of higher 
weight than 12 do suffer some cancellation with the beginning of the circulants. In 
fact, exhaustive weight spectrum analysis, (see Chaps.5 and 13 for description of 
the different methods that can be used), shows that the multiplicity of weight 12 
codewords is 714 for the (68, 34, 12) code and only 183 for the (120, 60, 12) code. 

Moreover, the covering radius of the (68, 34, 12) code has been evaluated and 
found to be 10 indicating that this code is well packed, whereas the covering radius 
of the (120, 60, 12) code is much higher at 16 indicating that the code is not so 
well packed. Indeed the code rate of the (120, 60, 12) code can be increased without 
degrading the minimum Hamming distance because with a covering radius of 16 at 
least one more information bit may be added to the code. 

With maximum likelihood, hard decision decoding, which the modified Dorsch 
decoder is able to achieve, up to 10 hard decision errors can be corrected with the 
(68, 34, 12) code in comparison with up to 16 hard decision errors correctable by the 
(120, 60, 12) code. Note that these are considerably higher numbers of correctable 
errors in both cases than suggested by the d free of the code (only five hard decision 
errors are guaranteed to be correctable). This is a recurrent theme for maximum 
likelihood, hard decision decoding of codes, as discussed in Chap.3, compared to 
bounded distance decoding. 

Itis also interesting to compare the performance of other convolutional codes that 
have been designed for space applications and were originally intended to be used 
with sequential decoding. Of course now we have available the far more powerful 
(and more signal processing intensive) modified Dorsch decoder, which can be used 
with any linear code. 

Massey and Costello [6, 10] constructed a rate 1, memory 31 non-systematic 
code which was more powerful than any systematic code with the same memory 
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and had the useful property that the information bits could be obtained from the two 
convolutionally encoded parity streams just by adding them together, modulo 2. The 
necessary condition for this property is that the two generator polynomials differ 
only in a single coefficient. The two generator polynomials, ro(x) and r; (x) may be 
described by the exponents of the non-zero coefficients: 


ro(x) < (0, 1, 2, 4, 5, 7, 8, 9, 11, 13, 14, 16, 17, 18, 19, 21, 22, 23, 24, 25, 27, 28, 29, 31} 
ғі(х) < (0, 2, 4, 5, 7, 8, 9, 11, 13, 14, 16, 17, 18, 19, 21, 22, 23, 24, 25, 27, 28, 29, 31} 


As can be seen the two generator polynomials differ only in the coefficient of x. 
This code has a df,ee of 23 and сап be realised as a double-circulant (180, 90, 23) 
code from the tail-biting version of the same convolutional code. This convolutional 
code has exceptional performance and in double-circulant form it, of course, may 
be decoded using the extended Dorsch decoder. The performance of the code in 
(180, 90, 23) form, for the soft decision and hard decision AWGN channel, is shown 
in Fig. 10.2. For comparison purposes, the performances of the Pioneer 9 codes are 
also shown in Fig. 10.2. Shorter double-circulant code constructions are possible 
from this convolutional code in tail-biting form, without compromising the а, of 
the double-circulant code. The shortest version is the (166, 83, 23) double-circulant 
code. 
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Fig. 10.2 BER performance of the Massey Costello convolutional code in (180, 90, 23) double- 
circulant code form for the AWGN channel, using soft and hard decisions, with extended Dorsch 
decoding 
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By truncating the generator polynomials, ro(x) and r; (x) above, a reduced mem- 
ory convolutional code with memory 23 and ау,гг of 17 can be obtained as dis- 
cussed by Massey and Lin [6, 10] which still has the non-systematic, quick decoding 
property. The generator polynomials are given by the exponents of the non-zero 
coefficients: 


Fo(x) < (0, 1, 2, 4, 5, 7, 8, 9, 11, 13, 14, 16, 17, 18, 19, 21, 22, 23} 
FA (x) < (0,2, 4, 5, 7, 8, 9, 11, 13, 14, 16, 17, 18, 19, 21, 22, 23} 


A (160, 80, 17) double-circulant code can be obtained from the tail-biting version 
of this convolutional code. In fact, many double-circulant codes with high dmin can 
be obtained from tail-biting versions of convolutional codes. 

It is straightforward to write a program in C++ which searches for the generator 
polynomials that produce the convolutional codes with the highest values of d free. 
The only other constraint is that the the generator polynomials need to be relatively 
prime to each other, that is, the GCD of the generator polynomials needs to be 1 
in order to avoid a catastrophic code [6]. However, it is also necessary in selecting 
the generator polynomials that the wrap around effects of the circulants are taken 
into account otherwise the а, of the double-circulant code is not as high as the 
d free Of the convolutional code from which it is derived. Indeed to construct a good 
code in this way with high d f,ee and high dnin, it has to be constructed as a tail- 
biting convolutional code right from the start. One example of a good tail-biting 
convolutional code that has been found in this way has generator polynomials, ro (x) 
and ғ (x) given by the exponents of the non-zero coefficients: 


ғо(х) < (0, 2, 5, 8, 9, 10, 12, 13, 14, 15, 27] 
ri(x) < (0,1, 2, 3, 4, 5, 7, 8, 11, 12, 16, 18, 20, 23, 27] 


This code has a memory of 27 and a d free of 26. It may be realised in double-circulant 
form as a (180, 90, 26) double-circulant code and weight spectrum analysis shows 
that this code has the same dmin of 26 as the best-known code with the same code 
parameters [4]. The two polynomials ro(x) and rı (x) factorise into polynomials with 
the following exponents of the non-zero coefficients: 


ғо(х) <- (0, 3, 5}{0, 2, 3, 5, 6, 7, 8, 10, 13, 14, 16, 17, 18, 20, 22} 
ri(x) < 10, 3, 5, 6, 8}{0, 1, 3, 4, 5, 6, 8,(0, 2, 4, 7, 11} 


It can be seen that neither polynomial has a common factor and so the GCD is 1. 
Correspondingly, the convolutional code is not a catastrophic code. 

As well as constructing double-circulant codes from convolutional codes, double- 
circulant codes may be used to construct good convolutional codes. The idea of 
generating convolutional codes from good block codes is not that new. Massey et al. 
іп 1973 generated a convolutional code for space communications from a (89, 44, 18) 
quadratic residue cyclic code [5, 6]. As described in Chap. 9, prime numbers which 
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are congruent to +3 modulo 8 may be used to generate double-circulant codes using 
the quadratic residues to construct one circulant, the other circulant being the identity 
circulant; the length of the circulants are equal to the prime number. 

Particularly, good double-circulant codes are obtained in this way as discussed in 
Chap. 9. For example, the prime number 67 can be used to generate а (134, 67, 23) 
double-circulant code with the circulants defined by the two polynomials with the 
following exponents of the non-zero coefficients: 


ro(x) <- (0) 
ri(x) < (0, 1, 4, 6, 9, 10, 14, 15, 16, 17, 19, 21, 22, 23, 24, 25, 26, 29, 33, 35, 36, 
37, 39, 40, 47, 49, 54, 55, 56, 59, 60, 62, 64, 65] 


Using these two polynomials as the generator polynomials for a 1 rate convolutional 
code, a systematic convolutional code having a d fee of 30 is obtained. Interestingly, 
deriving another double-circulant code from the tail-biting version of this convolu- 
tional code only produces good results when the circulants are exactly equal to 67, 
thereby reproducing the original code. For longer circulants, the dmin is degraded 
unless the circulants are much longer. It is found that the circulants have to be as 
long as 110 to produce a (220, 110, 30) double-circulant code having a dmin equal 
to that of the original convolutional code. Moreover, this is a good code because the 
code has the same parameters as the corresponding best-known code [4]. 

A double-circulant code may also be used to derive a non-systematic convolutional 
code with much smaller memory and a d у, „г equal to the dmin of the double-circulant 
code by selecting a codeword of the double-circulant code which features low-degree 
polynomials in each circulant. It is necessary to check that these polynomials are 
relatively prime otherwise a catastrophic convolutional code is produced. In this event 
a new codeword is selected. The code produced is a non-systematic convolutional 
code with memory equal to the highest degree of the two circulant polynomials. 
For example, a memory 41 non-systematic convolutional code can be derived from 
a memory 65, systematic convolutional code based on the (134, 67, 23) double- 
circulant code with the following exponents of the non-zero coefficients: 


ro(x) <- (0) 
r(x) < 10,1,4,6,9, 10, 14, 15, 16, 17, 19, 21, 22, 23, 24, 25, 26, 29, 33, 35 
36, 37, 39, 40, 47, 49, 54, 55, 56, 59, 60, 62, 64, 65] 


Codeword analysis of the double-circulant code is carried out to find the low 
memory generator polynomials. The following two generator polynomials were 
obtained from the two circulant polynomials making up a weight 23 codeword of 
the (134, 67, 23) code: 


ғо(х) < (0, 1, 2, 4, 5, 10, 12, 32, 34, 36, 39, 41} 
ri(x) < (0, 2, 4, 13, 19, 24, 25, 26, 33, 35, 37} 
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In another example, the outstanding (200, 100, 32) extended cyclic quadratic 
residue code may be put in double-circulant form using the following exponents 
of the non-zero coefficients: 


ғо(х) <- {0} 

п.(х) < (0, 1, 2, 5,6, 8,9, 10, 11, 15, 16, 17, 18, 19, 20, 26, 27, 28, 31, 34, 35, 37, 
38, 39, 42, 44, 45, 50, 51, 52, 53, 57, 58, 59, 64, 66, 67, 70, 73, 75, 76, 
77, 80, 82, 85, 86, 89, 92, 93, 97, 98} 


Enumeration of the codewords shows that there is a weight 32 codeword that 
defines the generator polynomials of a memory 78, non-systematic convolutional 
code. The codeword consists of two circulant polynomials, the highest degree of 
which is 78. The generator polynomials have the following exponents of the non- 
Zero coefficients: 


ғо(х) <- (0, 2, 3, 8, 25, 27, 37, 44, 50, 52, 55, 57, 65, 66, 67, 69, 74, 75, 78} 
гі(х) < 10,8, 14, 38, 49, 51, 52, 53, 62, 69, 71, 72, 73} 


The non-systematic convolutional code that is produced has a d free of 32 equal 
to the dmin of the double-circulant code. Usually, it is hard to verify high values 
of dfree for convolutional codes, but in this particular case, as the convolutional 
code has been derived from the (200, 100, 32) extended quadratic residue, double- 
circulant code which is self-dual and also fixed by the large projective special linear 
group P SL5(199) the dmin of this code has been proven to be 32 as described in 
Chap. 9. Thus, the non-systematic convolutional code that is produced has to have a 
d free of 32. 


10.5 Summary 


Convolutional codes have been explored from a historical and modern perspective. 
Their performance, as traditionally used, has been compared to the performance 
realised using maximum likelihood decoding featuring an extended Dorsch decoder 
with the convolutional codes implemented as tail-biting block codes. It has been 
shown that the convolutional codes designed for space applications and sequential 
decoding over 40 years ago were very good codes, comparable to the best codes 
known today. The performance realised back then was limited by the sequential 
decoder as shown by the presented results. An additional 2 dB of coding gain could 
have been realised using the modern, extended Dorsch decoder instead of the sequen- 
tial decoder. However back then, this decoder had yet to be discovered and was 
probably too expensive for the technology available at the time. 

It has also been shown that convolutional codes may be used as the basis for 
designing double-circulant block codes and vice versa. In particular, high, guaranteed 
values of d f ee may be obtained by basing convolutional codes on outstanding double- 
circulant codes. A memory 78, non-systematic, half rate convolutional code with a 
d free Of 32 was presented based on the (200, 100, 32) extended quadratic residue, 
double-circulant code. 
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Chapter 11 


Analogue BCH Codes and Direct Reduced 
Echelon Parity Check Matrix Construction 


11.1 Introduction 


Analogue error-correcting codes having real and complex number coefficients were 
first discussed by Marshall [2]. Later on Jack Wolf [3] introduced Discrete Fourier 
Transform (DFT) codes having complex number coefficients and showed that an 
(n, k) DFT code can often correct up to n — k — 1 errors using a majority voting 
type of decoder. The codes are first defined and it is shown that (n, k) DFT codes 
have coordinate coefficients having complex values. These codes have a minimum 
Hamming distance of n — k -- 1 and are Maximum Distance Separable (MDS) 
codes. The link between the Discrete Fourier Transform and the Mattson-Solomon 
polynomial is discussed and it is shown that the parity check algorithm used to 
generate DFT codes can be applied to all BCH codes including Reed-Solomon codes 
simply by switching from complex number arithmetic to Galois Field arithmetic. 
It is shown that it is straightforward to mix together quantised and non-quantised 
codeword coefficients which can be useful in certain applications. Several worked 
examples are described including that of analogue error-correction encoding and 
decoding being applied to stereo audio waveforms (music). 

In common with standard BCH or Reed-Solomon (RS) codes, it is shown that 
parity check symbols may be calculated for any n — К arbitrary positions in each 
codeword and an efficient method is described for doing this. A proof of the validity 
of the method is given. 


11.2 Analogue BCH Codes and DFT Codes 


In a similar manner to conventional BCH codes, a codeword of an analogue (7, К) 
BCH code is defined as 


2 3 4 5 = 
C(x) = co + сх + cox^ + c3xX? + 04x" + esx? + 4 e, x" 
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where 
с(х) = g(x)d(x) 


g(x) is the generator polynomial of ће code with degree n — К and d(x) is any data 
polynomial of degree less than k. Correspondingly, 


g(x) = go + gix + gax? +--+ + нах" 


and 
dix) = dọ + dix hx? $s the gx 


The coefficients of c(x) are complex numbers from the field of complex numbers. 
A parity check polynomial h(x) is defined, where 


h(x) = ho + hix + hax? + hax? + hax* + hax? +--+ yx”! 


where 
h(x)g(x) mod (x" — 1) 20 


and accordingly, 
h(x)c(x) mod (x" — 1) = 0 


The generator polynomial and the parity check polynomial may be defined in 
terms of the Discrete Fourier Transform or equivalently by the Mattson-Solomon 
polynomial. 


Definition 11.1 (Definition of Mattson—Solomon polynomial) The Mattson- 
Solomon polynomial of any polynomial a(x) is the linear transformation of a(x) 
to A(z) and is defined by [1], 


п—1 


A(z) = MS(a(x)) = У аа) г (11.1) 


і-0 
The inverse Mattson-Solomon polynomial or inverse Fourier transform is: 


п—1 


a(x) = MS ҚА())- DTE (11.2) 


і-0 
а is a primitive root of unity with order n and for analogue BCH codes 


‚2л 


а = е!" 


(11.3) 


where j = (-1)2. 
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In terms of a narrow sense, primitive BCH code with a generator polynomial of g (x), 
the coefficients of G(z) are all zero from 2° through z’-k-! and the coefficients of 
H(z) are all zero from z"-* through z"-!. Consequently, it follows that the coefficient 
by coefficient product of G(z) and H(z) represented by © 


n-l 
G@) © H(2) = * (G; O Hj)z =0 (11.4) 
j-0 
The nonzero terms of Н (z) extend from z? through to 2775-! and a valid parity check 
matrix in the well known form is: 
1 1 1 zs 1 
1 ao! o? suec ud 
1 o? at s. OAD 
H= 1 o? "i o30-D 


1 оте! a 2n-k- a --Ma-D 


It will be noticed that each row of this matrix is simply given by the inverse Mattson- 
Solomon polynomial of H (z), where 


Н(д- 1 

Н(:) = 2 

Н(ә = 2 (11.5) 
Н(2) = ... 

H(z) = "7-1 


Consider H(z) = z—o/,the inverse Mattson-Solomon polynomial produces a parity 
check equation defined by 


Notice that this parity check equation may be derived from linear combinations of 
the first two rows of H by multiplying the first row by о before subtracting it from 
the second row of H. The resulting row may be conveniently represented by 


о% а ае а... 0)... а ае 


It will be noticed that the i" coordinate of the codeword is multiplied by zero, 
and hence the parity symbol obtained by this parity check equation is independent 
of the value of the i^" coordinate. Each one of the other coordinates is multiplied 
by a nonzero value. Hence any one of these п — 1 coordinates may be solved using 
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this parity check equation in terms of the other и — 2 coordinates involved in the 
equation. 

Similarly, considering Н (2) = z — o, the inverse Mattson-Solomon polynomial 
produces a parity check equation defined by 


and this may be conveniently represented by 


bo bi b, 


оо ай о? gos, 0... ghi ybi 

Now the j"" coordinate is multiplied by zero and hence the parity symbol obtained 

by this parity check equation is independent of the value of the j"" coordinate. 
Developing the argument, if we consider H(z) = (z — o!)(z — o), the inverse 


Mattson-Solomon polynomial produces a parity check equation defined by 
оба ота? ...0... 0... отор" 


This parity check equation has zeros in the i" and j"" coordinate positions and 
as each one of the other coordinates is multiplied by a nonzero value, any one of 
these n — 2 coordinates may be solved using this parity check equation in terms of 
the other n — 3 coordinates involved in the equation. 

Proceeding in this way, for H(z) = (z—a')(z—a/)(z—a*), the inverse Mattson— 
Solomon polynomial produces a parity check equation which is independent of the 
i^. j" апа! coordinates and these coordinate positions may be arbitrarily chosen. 
The parity check matrix is 


1 1 1 1 11... 1 
a ай a аз о 0... а"! 
a” O0 оза” оз 0... а?! 
a” 0 о” 0 а" 0... qh! 


На- 


The point here is that this parity check matrix Н,, has been obtained from linear 
combinations of the original parity check matrix H and all parity check equations 
from either Н or Hm are satisfied by codewords of the code. 

The parity check matrix Hm may be used to solve for 4 parity check symbols in 4 
arbitrary coordinate positions defined by the i^", /'" and К!” coordinate positions plus 
any one of the other coordinate positions which will be denoted as the /'" position. 
The coordinate value in the /'" position is solved first using the last equation. Parity 
symbols in the i^^, j!” and К'” positions are unknown but this does not matter as 
these are multiplied by zero. The third parity check equation is used next to solve 
for the parity symbol in the А7” position. Then, the second parity check equation is 
used to solve for the parity symbol in the j^" position and lastly, the first parity check 
equation is used to solve for the parity symbol іп the i^^ position. The parity check 
matrix values, for s = 0 through to п — 1, are given by: 
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а – о! 
а” = (a? — о!) (о° — a) = a^ (0° — a) 
а = (ag? — a')(a? — æ’) (as ak) = а" (œf — a^) 


Codewords of the code may be produced by first deciding on the number of parity 
check symbols and their positions and then constructing the corresponding parity 
check matrix Hm. From the information symbols, the parity check symbols are cal- 
culated by using each row of H,, starting with the last row as described above. 

In the above, there are 4 parity check rows and hence 4 parity check symbols 
which can be in any positions of the code. Clearly, the method can be extended 
to any number of parity check symbols. Any length of code may be produced by 
simply assuming coordinates are always zero, eliminating these columns from the 
parity check matrix. The columns of the parity check matrix may also be permuted 
to any order but the resulting code will not be cyclic. 

It follows that with the n — k parity check equations constructed using the method 
above, codeword coordinates may be solved in any of n — k arbitrary positions. In 
the construction of each parity check equation there is exactly one additional zero 
compared to the previously constructed parity check equation. Hence there are n — k 
independent parity check equations in any of n — К arbitrary positions. 

Since these equations are all from the same code the minimum Hamming distance 
of the code is n — k 4- 1 and the code is MDS. A system for the calculation of parity 
check symbols in arbitrary positions may be used for encoding or for the correction of 
erasures. А block diagram of such an encoder/erasures decoder is shown in Fig. 11.1. 


Input Vector 


SES Bee X E 
Multiply and Sum 


Register 
Register 
Register 


Q 
Register 


ер1зїег 


Invert 


Fig. 11.1 The efficient encoder/erasures decoder realisation for BCH codes 
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When operating as an erasures decoder in Fig. 11.1, the List of Parity Symbols is 
replaced with a list of the erasures positions. 


11.3 Error-Correction of Bandlimited Data 


In many cases, the sampled data to be encoded with the analogue BCH code is already 
bandlimited or near bandlimited in which case, the higher frequency coefficients of 
the Mattson-Solomon polynomial, D(z) of the data polynomial d (x), consisting of 
successive PAM samples, will be zero or near zero. An important point here is that 
there is no need to add additional redundancy with additional parity check samples. 
In a sense the data, as PAM samples, already contains the parity check samples. 
Commonly, it is only necessary to modify a small number of samples to turn the 
sampled data into codewords of the analogue BCH code as illustrated in the example 
below. The broad sense BCH codes are used with the following parity check matrix, 
witha = еті". 


i w^ ow? .. gw" DP 
1 Bt! gXE*D gD) 
В+2 2,2(8--2) (n—1)(B+2) 
He = 1 o a vw (OL _ (11.6) 
1 aft q2B43) gi DO) 
1-І 11 2. 1 


Using this parity check matrix will ensure that the highest n — k Fourier coefficients 
will be zero. Several alternative procedures may be used. n — k samples in each 
sequence of n samples may be designated as parity symbols and solved using this 
parity check matrix following the procedure above for constructing the reduced 
echelon matrix so that the values of the designated parity samples may be calculated. 
An alternative, more complicated procedure, is for each constructed codeword, to 
allow the n — k parity samples to be in any of ће z a Bi combinations of positions 
and choose the combination which produces the minimum mean squared differences 
compared to the original n — k complex samples. 


11.4 Analogue BCH Codes Based on Arbitrary 
Field Elements 


It is not necessary that the parity check matrix be based on increasing powers of a 
with parity check equations corresponding to the forcing of Fourier coefficients to 
be zero. An arbitrary ordering of complex field elements corresponding to permuted 
powers of а тау be used. With a = e^ where N > n, consider the parity check 
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matrix 
Qo Qo ао ao ао 
ао 941 a2 аз Qn-1 
2 2 2 2 
406 05 03 Ol 
H, = 3 3 3 3 
«o a 05 03 0 
n—k—-l „‚п—К—1 ,n—k—1 n—k-1l 
eo 01 а2 а а,-і 
The (oo, 01, 02, 03, ..., @,—1} complex number field elements are all distinct and 


arbitrary powers of о. Any combination of any n — К columns, or less, of this 
parity check matrix are independent because the matrix transpose is a Vandermonde 
matrix [1]. Consequently, the code is a (n, k, n — k 4- 1) MDS code. 

Following the same procedure as outlined above to produce directly a reduced 
echelon parity check matrix Hy with zeros in arbitrary columns, for example in three 
columns headed by, ag, o; and ос. 


ао оо ag a ss a 
Hp = (00 — oa) 0 (02 – оа) (оз — oa) ee (@p—| — a) 
(ay —aayag—ay) 0 0 (оз – аа)(аз а)... (01 — a) (s — ap) 
(ag — оа) (а) — аһ) (00 — ос) 0 0 (a3 — Qa) (аз — аһ)(оз — ое)... 0 


The parity check equation corresponding to the fourth row of this parity check 


matrix 15 
п—1 


J (oi = aa) (o — o) (o — ас = 0 (11.7) 


i=0 


where the analogue BCH codeword consists of п complex numbers 


(со, сі, C2, С3, ..., Сп-1} 


k of these complex numbers may be arbitrary, determined by the information source 
and n — k complex numbers are calculated from the parity check equations: 
Defining 


(e; — a) (0; — Op) (o; — о) = о? + Boa? + Bia} + Bo 
Parity check Eq. (11.7) becomes 
п—1 п п—1 


zl n—l 
У ас + fh У ос + Bi У aici + Bo У с = 0 (11.8) 
0 i=0 i=0 


i=0 i= 
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This codeword is from the same code as defined by the parity check matrix Н, 
because using parity check matrix Ha, codewords satisfy the equations 


п—1 п—1 п—1 п—1 
Жб оза 0 S ос =0 Уос = 0 > 4-0 
i=0 i=0 i=0 i=0 
and consequently the codewords defined by Н, satisfy (11.8) as 
0+ £20 + 810 + Bo0 = 0 


It is apparent that the reduced echelon matrix Нь consists of linear combinations of 
parity check matrix H, and either matrix may be used to produce the same MDS, 
analogue BCH code. 


11.5 Examples 


11.5.1 Example of Simple (5, 3, 3) Analogue Code 


This simple code is the extended analogue BCH code having complex sample values 
with a = ел” and uses the parity check matrix: 


1111 1 
= |; 


This parity check matrix is used to encode 3 complex data values in the last 3 
positions, viz (0.11 + 0.98j, -0.22- 0.88j, 0.33--0.78/). This produces the 
codeword: 


(—0.2—0.22j, —0.02—0.66j, 0.11--0.98j, -0.22-0.88/, 0.33--0.78/) 
Suppose the received vector has the last digit in error 
(-0.2-0.22/, —0.02— 0.66), 0.11 + 0.987, —0.22— 0.88j, 0.4 + 0.97) 


Applying the first parity check equation produces 0.07 + 0.127. This result tells us 
that there is an error of 0.07 4- 0.12 j in one of the received coordinates. Applying the 
second parity check equation produces 0.12 — 0.07 j. Since this is the error multiplied 
by — j, this tells us that the error is in the last coordinate. Subtracting the error from 
the last coordinate of the received vector produces (0.4 + 0.97) — (0.07 + 0.127) = 
0.33 + 0.78 j and the error has been corrected. 


11.5 Examples 307 


11.5.2 Example of Erasures Correction Using (15, 10, 4) 
Binary BCH code 


This is an example demonstrating that the erasures decoder shown in Fig. 11.1 may 
be used to correct erasures in a binary BCH code as well as being able to correct 
erasures using an analogue BCH code. 

The code is a binary BCH code of length n = 15, with binary codewords generated 
by the generator polynomial g(x) = (1+ x? + x^)(1 4- x). The Galois field is GF(2^) 
generated by the primitive гоого, which is a root of the primitive polynomial 1 4-x -x* 
so that 1 + a + a+ = 0, and the Galois field consists of the following table of 15 
field elements, plus the element, 0. 

One example of a codeword from the code is 


ex) =x Hx Hat Hai Ha ex arp (11.9) 


and consider that in a communication system, the codeword is received with erasures 
in positions in Ag = 5, А = 0 and Az = 8, so that the received codeword is 


$60) = ĉo + x Бас Ex H б tx? axl pg (11.10) 


To find the party check equations to solve for the erasures, referring to Fig. 11.1, the 
first parity check equation, ho(x), the all 175 vector is stored in the Register. The 
second parity check equation л (x) has zero for the coefficient of х"—^0="—5 and is 
given by 
п—1 
hi(x) = > (a) — a?) х) (11.11) 


j=0 


Note that л; (х).С(х) = 0 and these polynomials are derived with the intention that 
the coefficient of x^ will be evaluated. Referring to Fig. 11.1, | (x) is stored in the 
corresponding Register. After substitution using Table 11.1, it is found that 


hi(x) = o? + 8x + atx? + a x? + ох + х? 
Барақты eee au 


Jen x ere” ally (11.12) 


Notice that although the codeword is binary, the coefficients of this equation are from 
the full extension field of GF(16). The third parity check equation h2(x) has zero in 
position п — A, = n — 0 and is given by 


п—1 


ho(x) = Se -1)х/ (11.13) 


j=0 
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after evaluation 


һ›(х) = eters? ute + axt tes 
3 
+ alx t Аа ЖЕСІ, 


+ ох allr? фах? 4 axl (11.14) 


Referring to Fig. 11.1, this polynomial is stored in the corresponding Register. 

The parity check equation which gives the solution for coefficient б is h3(x) = 
ho(x) © hi(x) © ho(x). Multiplying each of the corresponding coefficients together 
of the polynomials Aio (x), ^; (x) and h2(x) produces 

ha(x) = ax + 01252 + ally + 03 x4 + a2? 
жазба + alx’ gh? + gly 


dE ol 4x? + х1? gu MEM (11.15) 


Referring to Fig. 11.1, лз (х) will be input to Multiply and Sum. It should be noted 
that the parity check equation h3(x) has non-binary coefficients, even though the 
codeword is binary and the solution to the parity check equation has to be binary. 
Evaluating the coefficient of x? of h3(x)é(x) gives о 4--а + a! + o? + 6g + 
o? +a! + o? = 0, which simplifies to o/!! + ёв + 010 + o? = 0. Using Table 11.1 
gives 
(о ъа а?) + 8 + (1а +о2) c o? = 0 


Table 11.1 АП 15 Nonzero Galois Field elements of GF(16) 
Symbol ої modulo 1 +a+ a4 


с 


a= 1 

а! = a! 

a? = o? 

a? = o? 
at= 1-0 

añ = а+ 2 

б POS 3 
о- 1+а a 
a= 1+ o? 

a? = a+ o? 
010 1+ о o? 

allie » 42 "c 
a? = 1-0 o? o? 
ag? = 1+ az o? 
"m 1+ о3 
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and б = 1. Referring to Fig. 11.1, Select produces from h3(x) the value of the 
coefficient of x’ which is 1 and when inverted this is also equal to 1. The output of 
the Multiply and Add is 1, producing a product of 1, which is used by Update to 
update Cg = 1 in the Input Vector C(x). 

The parity check equation h2(x) gives the solution for coefficient бу. Evaluating 
the coefficient of x? of ha (x)ê(x) gives 


0 — o? +a 4a? + êa Ha 


+a Бо? p al? +a 


Substituting using Table 11.1 gives 650? = 0 and és = 0. 
Lastly the parity check equation ho(x) gives the solution for coefficient Со. Eval- 
uating the coefficient of x? of ho(x)6(x) gives 


O=cot14+14+14+14+14+14+141 (11.16) 
and it is found that со = 0, and the updated C(x) with all three erasures solved is 
OG) dx a pa? 3X 49, (11.17) 


equal to the original codeword. 


11.5.3 Example of (128, 112, 17) Analogue BCH Code 
and Error-Correction of Audio Data (Music) 
Subjected to Impulsive Noise 


In this example, a stereo music file sampled at 44.1 kHz in complex Pulse Ampli- 
tude Modulation (PAM) format is split into sequences of 128 complex samples and 
encoded using an analogue (128, 112, 17) BCH code with a = етш, апа reassem- 
bled into a single PAM stream. А short section of the stereo left channel waveform 
before encoding is shown plotted in Fig. 11.2. 

The encoding parity check matrix is the Н; matrix for bandlimited signals given 
above in matrix (11.6). There are 16 parity symbols and to make these obvious they 
are located at the beginning of each codeword. The same section of the stereo left 
channel waveform as before but after encoding is shown plotted in Fig. 11.3. The 
parity symbols are obvious as the newly introduced spikes in the waveform. 
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Fig. 11.2. Section of music waveform prior to encoding 
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Fig. 11.3 Section of music waveform after encoding 
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Fig. 11.4 Section of music waveform after encoding and subjected to impulse noise 


The parity symbols may be calculated for any combination of 16 coordinate posi- 
tions and in a more complicated encoding arrangement the positions could be selected 
as those that produce the minimum mean square error. However, the frequency com- 
ponents affected extend from 19.47 to 22.1 kHz (these components are equal to zero 
after encoding) and are beyond the hearing range of most people. 

The encoded music waveform is subjected to randomly distributed impulse noise 
with a uniformly distributed amplitude in the range +16000. The result is shown 
plotted in Fig. 11.4 for the same section of the waveform as before, although this is 
not obvious in the plot. 

The decoder strategy used is that in each received codeword the 16 received 
PAM samples with the greatest magnitudes exceeding a dynamic threshold or with 
largest change relative to neighbouring samples are erased. The erasures are then 
solved using the parity check equations as outlined above. In several cases, correctly 
received PAM samples are erased, but this does not matter provided the 112 non- 
erased samples in each received codeword are correct. The decoded music waveform 
is shown in Fig. 11.5, and is apparent that waveform after decoding is the same as 
the encoded waveform and the impulse noise errors have been corrected. 

Usually, impulse noise effects are handled by noise suppressors which produce 
short, zero-valued waveform sections. These audible gaps are irritating to the lis- 
tener. By using analogue BCH, error-correcting codes, there are no waveform gaps 
following decoding. 
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Fig. 11.5 Section of music waveform after decoding 


11.6 Conclusions and Future Research 


It has been demonstrated that for analogue (n, k, n — k + 1) BCH codes, parity check 
symbols having complex values may be calculated for any n — k arbitrary positions 
in each codeword and an efficient method of calculating erased symbols for any BCH 
code including binary codes has been presented. Bandlimited data naturally occurs 
in many sources of information. In effect the source data has already been encoded 
with an analogue BCH code. In practice the parity check equations of the BCH 
code will only approximately equal zero for the PAM samples of the bandlimited 
source. There is scope for determining those samples which require the minimum 
of changes in order to satisfy the parity check equations. Similarly in decoding 
codewords corrupted by a noisy channel there is the opportunity to use the statistics 
of the noise source to design a maximum likelihood decoder for analogue BCH 
codes. It appears likely that the extended Dorsch decoder described in Chap. 15 may 
be adapted for analogue BCH codes. 

There are many ad hoc noise suppression algorithms used on analogue video 
and audio waveforms which cause artefacts in the signal processed outputs. There 
appears to be an opportunity to improve on these by using analogue BCH coding 
since the output of the decoder is always a codeword. For high quality systems this 
will predominantly be the transmitted codeword and therefore the decoder output 
will be free of artefacts. 

Whilst most communications these days is digitally based, analogue communi- 
cations is usually far more bandwidth efficient, particularly in wireless applications. 
By using analogue BCH codes, analogue communications may be attractive once 
more, particularly for niche applications. 
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Steganography is another area in which analogue BCH codes may be utilised. 
Errors in parity check equations may be used to communicate data in a side channel. 
By virtue of the parity check equations these errors may be distributed over multiple 
PAM samples or pixels. Secrecy may be assured by using a combination of secret 
permutations of the parity check matrix columns and a secret linear matrix trans- 
formation so that the parity check equations are unknown by anyone other than the 
originator. 


11.7 Summary 


Many information sources are naturally analogue and must be digitised if they are 
to be transmitted digitally. The process of digitisation introduces quantisation errors 
and increases the bandwidth required. The use of analogue error-correcting codes 
eliminates the need for digitisation. It been shown that analogue BCH codes may 
be constructed in the same way as finite field BCH codes, including Reed-Solomon 
codes. The difference is that the field of complex numbers is used instead of a prime 
field or prime power field. It has been shown how the Mattson-Solomon polynomial 
or equivalently the Discrete Fourier transform may be used as the basis for the 
construction of analogue codes. It has also been shown that a permuted parity check 
matrix produces an equivalent code using a primitive root of unity to construct the 
code as in discrete BCH codes. 

A new algorithm was presented which uses symbolwise multiplication of rows 
of a parity check matrix to produce directly the parity check matrix in reduced 
echelon form. The algorithm may be used for constructing reduced echelon parity 
check matrices for standard BCH and RS codes as well as analogue BCH codes. 
Gaussian elimination or other means of solving parallel, simultaneous equations are 
completely avoided by the method. It was also proven that analogue BCH codes are 
Maximum Distance Separable (MDS) codes. Examples have been presented of using 
the analogue BCH codes in providing error-correction for analogue, band-limited 
data including the correction of impulse noise errors in BCH encoded, analogue stereo 
music waveforms. It is shown that since the data is bandlimited it is already redundant 
and the parity check symbols replace existing values so that there is no need for 
bandwidth expansion as in traditional error-correcting codes. Future research areas 
have been outlined including an analogue, maximum likelihood, error-correcting 
decoder based on the extended Dorsch decoder of Chap. 15. Steganography is another 
future application area for analogue BCH codes. 
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Chapter 12 
LDPC Codes 


12.1 Background and Notation 


LDPC codes are linear block codes whose parity-check matrix—as the name 
implies—is sparse. These codes can be iteratively decoded using the sum prod- 
uct [9] or equivalently the belief propagation [24] soft decision decoder. It has been 
shown, for example by Chung et al. [3], that for long block lengths, the performance 
of LDPC codes is close to the channel capacity. The theory of LDPC codes is related 
to a branch of mathematics called graph theory. Some basic definitions used in graph 
theory are briefly introduced as follows. 


Definition 12.1 (Vertex, Edge, Adjacent and Incident) A graph, denoted by G(V, E), 
consists of an ordered set of vertices and edges. 


e (Vertex) А vertex is commonly drawn as а node or a dot. The set V (С) consists 
of vertices of G(V, E) and if v is a vertex of G(V, E), itis denoted as v в V(G). 
The number of vertices of V (G) is denoted by |V (G)]. 

(Edge) An edge (u, v) connects two vertices u € V(G) and v € V(G) and it 
is drawn as a line connecting vertices u and v. The set E(G) contains pairs of 
elements of V (G), i.e. ((u, v) | u,v e V(G)}. 

(Adjacent and Incident) If (и, v) е E(G), then и € V(G) and v є V(G) are 
adjacent or neighbouring vertices of G(V, E). Similarly, the vertices u and v are 
incident with the edge (u, v). 


Definition 12.2 (Degree) The degree of a vertex v € V(G) is the number of edges 
that are incident with vertex v, i.e. the number of edges that are connected to vertex v. 


Definition 12.3 (Bipartite or Tanner graph) Bipartite or Tanner graph G(V, E) 
consists of two disjoint sets of vertices, say V,(G) and V,(G), such that V(G) = 
V,(G) U V,(G), and every edge (vi, pj) € E(G), such that v; є V,(G) and p; € 
V, (G) for some integers i and j. 
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An [n, k, d] LDPC code may be represented by a Tanner graph G(V, E). The 
parity-check matrix Н of the LDPC code consists of |V,(G)| = n — К rows and 
|V,(G)| = n columns. The set of vertices V,(G) and V,(G) are called variable and 
parity-check vertices, respectively. Figure 12.1 shows the parity check and the cor- 


Ug Uj 92 ©з V4 U5 Ug 17 Ug Ug Vin 011 V12 V13 014 015 
1113100000000 0 0 0 0 |? 
000011 1100000 0 0 0 |? 
000000001 11 1 0 0 0 оу» 
000000000001 0 1 1 1 (|) 
00011000000 0 0 1 1 O n^ 
H= 00100010101 0 0 0 0 0 № 
10000001 01 0 0 0 1 0 O |5 
000100100100 1 оо 0 |> 
00100000 10 0 0 1 0 0 1 јр 
01000101000 0 1 0 0 0 |» 
10000100001 0 0 0 1 O [ро 
010010000001 0 0 0 1 јр 


(a) Parity check matrix 


P10 
Pu 


(b) Tanner graph 


Fig. 12.1 Representations of a |16, 4, 4] LDPC code 
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responding Tanner graph of a [16, 4, 4] LDPC code. Let V,(G) = (vo, vi, ..., Vn—1) 
and V,(G) = (ро, pi, ..., Рп—к—1); we can see that for each (vi, pj) є E(G), the 
ith column and jth row of H, Ну); 5 0, forüxizn-—landO0xjzn-—k-l. 


Definition 12.4 (Cycle) A cycleina graph G(V, E) isasequence of distinct vertices 
that starts and ends in the same vertex. For bipartite graph G(V, E), exactly half of 
these distinct vertices belong to V,(G) and the remaining half belong to V, (G). 


Definition 12.5 (Girth and Local Girth) The girth of graph G(V, E) is the length 
of the shortest cycle in the graph G(V, Е). The local girth of a vertex v е V(G) is 
the length of shortest cycle that passes through vertex v. 


The performance of a typical iteratively decodable code (e.g. an LDPC or turbo 
code) may be partitioned into three regions, namely erroneous, waterfall and error 
floor regions, see Fig. 12.2. The erroneous region occurs at low Е,/ No values and 
is indicated by the inability of the iterative decoder to correctly decode almost all 
of the transmitted messages. As we increase the signal power, the error rate of the 
iterative decoder decreases rapidly—resembling a waterfall. The Е,/ № value at 
which the waterfall region starts is commonly known as the convergence threshold 
in the literature. At higher Ер / № values, the error rate starts to flatten—introducing 
an error floor in the frame error rate (FER) curve. 

In addition to this FER curve, the offset sphere packing lower bound and the 
probability of error based on the union bound argument as described in Chap. 1 are 
also plotted in Fig. 12.2. The sphere packing lower bound represents the region of 
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Fig. 12.2 Waterfall and error regions of a typical LDPC code for the AWGN channel 
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attainable performance of a coding system. The performance to the left of this lower 
bound is not attainable, whereas that to the right may be achieved by some coding 
and decoding arrangements. The other curve is the union bound of the probability of 
error, which is dominated by the low Hamming weight codewords and the number of 
codewords of these Hamming weights. The larger the minimum Hamming distance 
of a code, the lower the union bound typically. For iteratively decodable codes which 
are not designed to maximise the minimum Hamming distance, the union bound 
intersects with the offset sphere packing lower bound at relatively low E; / No values. 

It may be seen that, with an ideal soft decision decoder, the performance of a 
coding system would follow the sphere packing lower bound and at higher Е,/ No 
values, the performance floors due to the limitation of the minimum Hamming weight 
codewords. However, as depicted in Fig. 12.2, there is a relatively wide gap between 
the union bound and the error floor of a typical iteratively decodable code. This 
is an inherent behaviour of iteratively decodable codes and it is attributed to the 
weakness of the iterative decoder. There are other error events, which are not caused 
by the minimum Hamming weight codewords, that prevent the iterative decoder from 
reaching the union bound. 

In terms of the construction technique, we may divide LDPC codes into two 
categories: random and algebraic LDPC codes. We may also classify LDPC codes 
into two categories depending on the structure of the parity-check matrix, namely 
regular and irregular codes—refer to Sect. 12.1.1 for the definition. Another attractive 
construction method that has been shown to offer capacity-achieving performance 
is non-binary construction. 


12.1.1 Random Constructions 


Gallager [8] introduced the (п, А, o) LDPC codes where represents the block length 
whilst the number of non-zeros per column and the number of non-zeros per row are 
represented by A and p, respectively. 

The short notation (A, o) is also commonly used to represent these LDPC codes. 
The coderate of the Gallager (A, o) codes is given by 


R=1--. 
p 


An example of the parity-check matrix of a Gallager (A, р) LDPC code is shown 
in Fig. 12.1a. Itis a [16, 4, 4] code with a à of 3 and a p of 4. The parity-check matrix 
of the (A, p) Gallager codes always have a fixed number of non-zeros per column 
and per row, and because of this property, this class of LDPC codes is termed regular 
LDPC codes. The performance of the Gallager LDPC codes in the waterfall region 
is not as satisfactory as that of turbo codes for the same block length and code rate. 
Many efforts have been devoted to improve the performance of the LDPC codes and 
one example that provides significant improvement is the introduction of the irregular 
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LDPC codes by Luby et al. [18]. The irregular LDPC codes, as the name implies, 
do not have a fixed number of non-zeros per column or per row and thus the level 
of error protection varies over a codeword. The columns of a parity check matrix 
that have a higher number of non-zeros provide stronger error protection than those 
that have a lower number of non-zeros. Given an input block in iterative decoding, 
errors in the coordinates of this block, whose columns of the parity-check matrix 
have a larger number of non-zeros, will be corrected earlier, i.e. only a small number 
of iterations are required. In the subsequent iterations, the corrected values in these 
coordinates will then be utilised to correct errors in the remaining coordinates of the 
block. 


Definition 12.6 (Degree Sequences) The polynomial A; (х) = О;- ых! is called 
the symbol or variable degree sequence, where À; is the fraction of vertices of degree 
i. Similarly, Л„(х) = УХ). pix! is the check degree sequence, where p; is the 
fraction of vertices of degree i. 


The degree sequences given in the above definition are usually known as vertex- 
oriented degree sequences. Another representations are edge-oriented degree 
sequences which consider the fraction of edges that are connected to a vertex of 
certain degree. Irregular LDPC codes are defined by these degree sequences and it 
is assumed that the degree sequences are vertex-oriented. 


Example 12.1 An irregular LDPC code with the following degree sequences 


Ax (x) = 0.5x? + 0.26х° + 0.173? + 0.07x!° 
A, (x) = 0.80x ^ + 0.20x 


has 50, 26, 17 and 726 ofthe columns with 2, 3, 5 and 10 ones per column, respectively, 
and 80 and 20% of the rows with 14 and 15 ones per row, respectively. 


Various techniques have been proposed to design good degree distributions. 
Richardson et al. [27] used density evolution to determine the convergence thresh- 
old and to optimise the degree distributions. Chung et al. [4] simplified the density 
evolution approach using Gaussian approximation. With the optimised degree dis- 
tributions, Chung et al. [3] showed that the bit error rate performance of a long block 
length (n — 107) irregular LDPC code was within 0.04 dB away from the capacity 
limit for binary transmission over the AWGN channel, discussed in Chap. 1. This is 
within 0.18 dB of Shannon's limit [30]. The density evolution and Gaussian approxi- 
mation methods, which make use of the concentration theorem [28], can only be used 
to design the degree distributions for infinitely long LDPC codes. The concentration 
theorem states that the performance of cycle-free LDPC codes can be characterised 
by the average performance of the ensemble. The cycle-free assumption is only valid 
for infinitely long LDPC codes and cycles are inevitable for finite block-length LDPC 
codes. As may be expected, the performance of finite block-length LDPC codes with 
degree distributions derived based on the concentration theorem differs considerably 
from the ensemble performance. There are various techniques to design good finite 
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block-length LDPC codes, for instance see [1, 2, 10, 33]. In particular, the work of 
Hu et al. [10] with the introduction of the progressive edge-growth (PEG) algorithm 
to construct both regular and irregular LDPC codes, that of Tian et al. [33] with 
the introduction of extrinsic message degree and recently, that of Richter et al. [29] 
which improves the original PEG algorithm by introducing some construction con- 
straints to avoid certain cycles involving variable vertices of degree 3, have provided 
significant contributions to the construction of practical LDPC codes as well as the 
lowering of the inherent error floor of these codes. 


12.1.2 Algebraic Constructions 


In general, LDPC codes constructed algebraically have a regular structure in their 
parity-check matrix. The algebraic LDPC codes offer many advantages over ran- 
domly generated codes. Some of these advantages are 


1. The important property such as the minimum Hamming distance can be easily 
determined or in the worst case, lower and upper bounds may be mathematically 
derived. These bounds are generally more accurate than estimates for random 
codes. 

2. The minimum Hamming distance of algebraic LDPC codes is typically higher 
than that of random codes. Due to the higher minimum Hamming distance, alge- 
braic codes are not that likely to suffer from an early error floor. 

3. The existence of a known structure in algebraic codes usually offers an attractive 
and simple encoding scheme. In the case of random codes, in order to carry 
out encoding, a Gaussian elimination process has to be carried out in the first 
place and the entire reduced echelon parity-check matrix has to be stored in 
the memory. Algebraically constructed codes such as cyclic or quasi-cyclic codes 
can be completely defined by polynomials. The encoding of cyclic or quasi-cyclic 
codes may be simply achieved using a linear-feedback shift-register circuit and 
the memory requirement is minimum. Various efficient techniques for encoding 
random LDPC codes have been proposed, see Ping et al. [26] for example, but 
none of these techniques simplifies the storage requirements. The simplicity of the 
encoder and decoder structure has led to many algebraically constructed LDPC 
codes being adopted as industry standards [5]. 

4. Cyclic LDPC codes have п low Hamming weight parity-check equations and 
therefore, compared to random codes, these cyclic LDPC codes have К extra 
equations for the iterative decoder to iterate with and this leads to improved 
performance. 


One of the earliest algebraic LDPC code constructions was introduced by 
Margulis [21] using the Ramanujan graphs. Lucas et al. [19] showed that the 
well-known different set cyclic (DSC) [36] and one-step majority-logic decodable 
(OSMLD) [17] codes have good performance under iterative decoding. The iter- 
ative soft decision decoder offers significant improvement over the conventional 
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hard decision majority-logic decoder. Another class of algebraic codes is the class 
of the Euclidean and projective geometry codes which are discussed in detail by 
Kou et al. [16]. Other algebraic constructions include those that use combinatorial 
techniques (13-15, 35]. 

It has been observed that in general, there is an inverse performance relationship 
between the minimum Hamming distance of the code and the convergence of the 
iterative decoder. Irregular codes converge well with iterative decoding, but the min- 
imum Hamming distance is relatively poor. In contrast, algebraically constructed 
LDPC codes, which have high minimum Hamming distance, tend not to converge 
well with iterative decoding. Consequently, compared to the performance of irreg- 
ular codes, algebraic LDPC codes may perform worse in the low SNR region and 
perform better in the high SNR region. This is attributed to the early error floor of 
the irregular codes. As will be shown later, for short block lengths (n < 350), cyclic 
algebraic LDPC codes offer some of the best performance available. 


12.1.3 Non-binary Constructions 


LDPC codes may be easily extended so that the symbols take values from the finite- 
field Fy» and Davey et al. [6] were the pioneers in this area. Given an LDPC code over 
IF? with parity-check matrix Н, we may construct an LDPC code over Fam form > 2 
by simply replacing every non-zero element of Н with any non-zero element of Fyn in 
arandom or structured manner. Davey et al. [6] and Hu et al. [11] have shown that the 
performance of LDPC codes can be improved by going beyond the binary field. The 
non-binary LDPC codes have better convergence behaviour under iterative decod- 
ing. Using some irregular non-binary LDPC codes, whose parity-check matrices are 
derived by randomly replacing the non-zeros of the PEG-constructed irregular binary 
LDPC codes, Hu et al. [11] demonstrated that an additional coding gain of 0.25 dB 
was achieved. It may be regarded that the improved performance is attributable to the 
improved graph structure in the non-binary arrangement. Consider a cycle of length 
6 in the Tanner graph of a binary LDPC code, which is represented as the following 
sequence of pairs of edges {(уо, ро), (уз, ро), (уз, рә), (уд, рә), (уа, P1), (Vo, р1)). 
If we replace the corresponding entries in the parity-check matrix with some non- 
zeros over Ез" for m > 2, provided that these six entries are not all the same, the 
cycle length becomes longer than 6. According to McEliece et al. [22] and Etzion 
et al. [7], the non-convergence of the iterative decoder is caused by the existence of 
cycles in the Tanner graph representation of the code. Cycles, especially those of 
short lengths, introduce correlations of reliability information exchanged in iterative 
decoding. Since cycles are inevitable for finite block length codes, it is desirable to 
have LDPC codes with large girth. 

The non-binary LDPC codes also offer an attractive matching for higher order 
modulation methods. The impact of increased complexity of the symbol-based iter- 
ative decoder can be moderated as the reliability information from the component 
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codes may be efficiently evaluated using the frequency-domain dual-code decoder 
based on the Fast Walsh-Hadamard transform [6]. 


12.2 Algebraic LDPC Codes 


Based on idempotents and cyclotomic cosets, see Chap. 4, a class of cyclic codes that 
is suitable for iterative decoding may be constructed. This class of cyclic codes falls 
into the class of one-step majority-logic decodable (OSMLD) codes whose parity- 
check polynomial is orthogonal on each bit position—implying the absence of a girth 
of 4 in the underlying Tanner graph, and the corresponding parity-check matrix is 
sparse, and thus can be used as LDPC codes. 


Definition 12.7 (Binary Parity-Check Idempotent) Let A С N and let the poly- 
nomial u(x) € T (x) be defined by 


u(x) = У ео) (12.1) 


SEM 


where e; (х) is an idempotent. The polynomial u(x) is called a binary parity-check 
idempotent. 


The binary parity-check idempotent u(x) can be used to describe an [n, k] cyclic 
code as discussed in Chap.4. Since GCD(u(x), x" — 1) = h(x), the polynomial 
a(x) = хе ШО), (х-1) and its n cyclic shifts (mod x" — 1) can be used to define 
the parity-check matrix of a binary cyclic code. In general, мір (и (х)) is much lower 
than wt н (^ (x)), and therefore a low-density parity-check matrix can be derived from 
u(x). 

Let the parity-check polynomial a(x) = x” + x"! +.--+ x" of weight t + 1. 
Since the code defined by u(x) is cyclic, for each non-zero coefficient и; in u(x), 
there are another ¢ parity-check polynomials of weight t + 1, which also have a 
non-zero coefficient at position и;. Furthermore, consider the set of these t + 1 
polynomials that have a non-zero coefficient at position и;, there is no more than 
one polynomial in the set that have a non-zero at position и; for some integer j. In 
other words, if we count the number of times the positions 0, 1,..., — 1 appear 
in the exponents of the aforementioned set of t + 1 polynomials, we shall find that 
all positions except u; appear at most once. This set of t + 1 polynomials is said to 
be orthogonal on position u;. The mathematical expression of this orthogonality is 
given in the following definition and lemma. 


Definition 12.8 (Difference Enumerator Polynomial) Let the polynomial f(x) € 
T (x). The difference enumerator of f(x), denoted as Z( f (x)), is defined as 


2070) = f œ) f (x !) = do dix а талл, (12.2) 
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where it is assumed that Z( f (x)) is a modulo x" — 1 polynomial with coefficients 
taking values from R (real coefficients). 


Lemma 12.1 Let d; for 0 < i < n — 1 denote the coefficients of Z(u(x)). If 
d; € (0, 1}, for alli € (1,2, ...,n — 1}, the parity-check polynomial derived from 
и(х) is orthogonal on each position in the n-tuple. Consequently, 


(i) the minimum distance of the resulting LDPC code is 1 + wtg (u(x)), and 
(ü) the underlying Tanner Graph has girth of at least 6. 


Proof (i) [25, Theorem 10.1] Let a codeword c(x) = co + cix +-+- сох"! and 
с(х) € T (x). For each non-zero bit position c; of c(x), where j € {0,1,...,n — 
1}, there are wtg (u(x)) parity-check equations orthogonal to position c;. Each of 
the parity-check equations must check another non-zero bit сі, where / 5 j, so 
that the equation is satisfied. Clearly, уін (c(x)) must equal to 1 + мін (u(x)) and 
this is the minimum weight of all codewords. 

(ii) The direct consequence of having orthogonal parity-check equations is the 
absence of cycles of length 4 in the Tanner Graphs. Let a, b and c, wherea « b « c, 
be three distinct coordinates in an n-tuple, since d; € (0, 1} for 1 <i € n — 1, this 
implies that b — a zz c — b. We know that q(b — a) (mod n) € (1,2,...,n— 1} 
and thus, q(b — a) (mod n) = (c — Б) for some integer q € (1,2, ...,n — 1}. If we 
associate the integers a, b and c with some variable vertices in the Tanner graph, a 
cycle of length 6 is produced. 


It can be deduced that the cyclic LDPC code with parity-check polynomial u(x) 
is an OSMLD code if d; є (0, 1}, for all i € (1,2,...,n — 1} or a difference set 
cyclic (DSC) code if d; = 1, for alli € {1, 2,..., n — 1}, where d; is the coefficient 
of Z(u(x)). 

In order to arrive at either OSMLD or DSC codes, the following design conditions 
are imposed on u(x) and therefore, u(x): 


Condition 12.1 The idempotent и(х) must be chosen such that 
Wty (u(x)) wta (u(x)) — D) E n — 1. 


Proof There are wty(u(x)) polynomials of weight мін (и(х)) that are orthogonal 
on position j for some integer /. The number of distinct positions in this set of 
polynomials is мін (u(x)) (їн (u(x)) — 1), and this number must be less than or 
equal to the total number of distinct integers between 1 and n — 1. 


Condition 12.2 Following Definition 12.8, let W = (i|d; 2l,l1xizn-1p 
the cardinality of W must be equal to мін (u(x)) (Wty (и(х)) — 1). 


Proof Тһе cyclic differences between the exponents of polynomial и(х) are given 
by 2 (и(х)) = 2 d;x', where the coefficient d; is the number of differences 
and the exponent i is the difference. The polynomial u(x) and some of its cyclic 
shifts are orthogonal on position 0 and this means that all of the cyclic differences 
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between the exponents of u(x) (excluding zero) must be distinct, i.e. d; € (0, 1) for 
1 <i Æ n — 1. Since the weight of u(x) excluding x? is мен (u(x)) — 1 and there 
аге Wty (u(x)) cyclic shifts of u(x) that are orthogonal to x, the number of distinct 
exponents in the cyclic differences is wtg (u(x)) (Wty (u(x)) — 1) = W. 


Condition 12.3 Тһе exponents of и(х) must not contain a common factor of л, 
otherwise a degenerate code, a repetition of a shorter cyclic code, is the result. 


Proof If the exponents of u(x) contain a common factor of n, p with n = pr, then 
factors of u(x) divide x” — 1 and form a cyclic code of length ғ. Every codeword of 
the longer code is a repetition of the shorter cyclic code. 


Condition 12.4 Following (12.1), unless мн (е; (х)) = 2, the binary parity-check 
idempotent e; (x) must not be self-reciprocal, i.e. е,(х) # e; (x~'), for alli € M. 


Proof The number of non-zero coefficients of Ф(е;(х)) is equal to 
Wty (es (x)) (wta (es(x)) — 1). 


For a self-reciprocal case, e, (x)e; (х=!) = е? (x) = е,(х) with wtg (e; (x)) non-zero 
coefficients. Following Condition 12.1, the inequality 


wty (es (x)) (мін (е; Ох) — 1) < wta (es (x)) 


becomes equality if and only if мін (е; (x)) = 2. 


Condition 12.5 Following (12.1), u(x) must not contain e; (х=), for all i € M, 
unless e, (x) is self-reciprocal. 


Proof If u(x) contains e, (х7!) for i € M, then Z(u(x)) will contain both 
е,(х)е, (х7!) and e, (х7!) e,(x), hence, some of the coefficients of 2(е,(х)), 
d; # (0, 1) for some integer i. 


Although the above conditions seem overly restrictive, they turn out to be helpful 
in code construction. Codes may be designed in stage-by-stage by adding candidate 
idempotents to u(x), checking the above conditions at each stage. 

In order to encode the cyclic LDPC codes constructed, there is no need to deter- 
mine g(x). With о defined as a primitive n" root of unity, it follows from Lemma 4.4 
that u(a') є (0,1) fon0 < i < n — 1. Let J = (jo Л....,.м—к—1) be a set of 
integers between 0 and n — 1, such that g(a/) = 0, for all j є f . Because u(x) 
does not contain o as its roots, it follows that u(a/) = 1, for all j € Х.В, 
1--и(о/) = 0 and the polynomial 1 + u(x) = es (x), the generating idempotent of 
the code may be used to generate the codewords as an alternative to g(x). 

The number of information symbols of the cyclic LDPC codes can be determined 
either from the number of roots of u(x) which are also roots of unity, i.e. n — 
мін (U (z)), or from the degree of (u(x), x" — 1) = h(x). 
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Example 12.2 Consider the design of a cyclic LDPC code of length 63. The cyclo- 
tomic coset modulo 63 is given in Example 4.2. Let u(x) be defined by Со, i.e. 
u(x) = eg(x) = x?(1 + x? + x”). 2(u(x)) indicates that the parity-check matrix 
defined by и(х) has no cycles of length 4; however, following Condition 12.3, it is 
a degenerate code consisting of repetitions of codewords of length 7. 

With u(x) = ez3(x) = x?(1 + x8 + x?9 + x? + x99 + x35), the resulting cyclic 
code is a [63, 31, 6] LDPC code which is non-degenerate and its underlying Tanner 
graph has girth of 6. This code can be further improved by adding e», (x) to u(x). 
Despite e», (x) being self-reciprocal, its weight is 2 satisfying Condition 12.4. Now, 
u(x) = x?! (1-- x? + x8 + x?! + x2 + x25 4 x9? + x57), and it is a [63, 37, 9] cyclic 
LDPC code. 


Based on the theory described above, an algorithm which exhaustively searches 
for all non-degenerate cyclic LDPC codes of length n which have orthogonal parity- 
check polynomials has been developed, and it is given in Algorithm 12.1. 


Algorithm 12.1 CodeSearch(V, index) 
Input: 
index <- an integer that is initialised to — 1 
V < а vector that is initialised to Й 
S «= „Л excluding 0 
Output: 
CodesList contains set of cyclic codes which have orthogonal parity-check polynomial 
1:T<V 
2: for (izindex4l;i < |Z|; i++) do 


3: Т = T 
4: if (Ж ует|С$,| < Vn, S, is the 1% element of S) then 
5: Append i to T 
6: и(х) = мет es, (х) 
7: if (и(х) is non-degenerate) and (и(х) is orthogonal on each position (Lemma 12.1)) 
then 
8: U(z) = MS (u(x)) 
9: К-п-мін (U(z)) 
10: € € a [n, k, 1 + мін (и(х))] cyclic code defined by u(x) 
11: if (k > 1) and (€ ¢ CodeList) then 
12: Add Со CodeList 
13: end if 
14: end if 
15: CodeSearch(T, i) 
16: endif 
17: T € Type 
18: end for 


Table 12.1 lists some example of codes obtained from Algorithm 12.1. Note that 
all codes with code rate less than 0.25 are excluded from the table and codes of longer 
lengths may also be constructed. We can also see that some of the codes in Table 12.1 
have the same parameters as the Euclidean and projective geometry codes, which 
have been shown by Jin et al. [16] to perform well under iterative decoding. 
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Table 12.1 Examples of 
2-cyclotomic coset-based 
LDPC codes 


12 LDPC Codes 


[n, k, d] Cyclotomic cosets 
[21, 11, 6] Ст, Co 

[63, 37, 9] C21, C23 

[93, 47, 8] C3, C31 

[73, 45, 10] С 

[105, 53, 8] C7, Cis 

[219, 101, 12] C3, C75 

[255, 135, 13] Ci, C119 

[255, 175, 17] СІ, C»; 

[273, 191, 18] СІ. C91, C117 
[341, 205, 16] Сі, Css 

[511, 199, 19] С5, C37 

[511, 259, 13] Ci, Сою 

|819, 435, 13] С 

|819, 447, 19] СІ, C351 
(1023, 661, 23] Ci, C53, C341 
[1023, 781, 33] СІ, C53, C123, C341 
[1057, 813, 34] C5, C43, C151 
[1387, 783, 28] Ci, Солт 
[1971, 1105, 21] C1, C657 
[2047, 1167, 23] СІ, C27 

|2325, 1335, 28] Ci, C57, C775 
[2325, 1373, 30] C1, C525, C1085 
[2359, 1347, 22] С, 

[3741, 2229, 29] Ci 


[3813, 2087, 28] 


СІ. C369, C1271 


(4095, 2767, 49] 


C1, C41, C235, C733 


[4095, 3367, 65] 


C1, C41, C235, C273, C411, C733 


[4161, 2827, 39] 


C1, C307, C1387 


[4161, 3431, 66] 


СІ. C285, C307, C357, C1387 


[4681, 2681, 31] 


СІ, C51 


[5461, 3781, 43] 


СІ. C77, C579 


A key feature of the cyclotomic coset-based construction is the ability to increment 
the minimum Hamming distance of a code by adding further weight from other 
idempotents and so steadily decrease the sparseness of the resulting parity-check 
matrix. Despite the construction method producing LDPC codes with no cycles of 
length 4, it is important to remark that codes that have cycles of length 4 in their parity- 
check matrices do not necessary have bad performance under iterative decoding, and 
a similar finding has been demonstrated by Tang et al. [31]. It has been observed 
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that there are many cyclotomic coset-based LDPC codes that have this property, and 
the constraints in Algorithm 12.1 can be easily relaxed to allow the construction of 
cyclic LDPC codes with girth 4. 


12.2.1 Mattson-Solomon Domain Construction of Binary 
Cyclic LDPC Codes 


The [n, k, d] cyclic LDPC codes presented in Sect. 4.4 are constructed using the sum 
of idempotents, which are derived from the cyclotomic cosets modulo п, to define 
the parity-check matrix. A different insight into this construction technique may be 
obtained by working in the Mattson-Solomon domain. 

Let n be a positive odd integer, Ез» be a splitting field for x" — 1 over Е, a bea 
generator for Fy», and Т,(х) be a polynomial with maximum degree of n — 1 and 
coefficients in Fn. Similar to Sect. 4.4, the notation of T (x) is used as an alternative to 
T (x) and the variables x апа z are used to distinguish the polynomials in the domain 
and codomain. Let the decomposition of z” — 1 into irreducible polynomials over Е 
be contained in a set F = { fi (2), fo(z),..., A} ie. 2 fi = z” — 1. For 
each f;(z), there is a corresponding primitive idempotent, denoted as Ө; (z), which 
can be obtained by [20] 


z(z" — 1) fi (x) 


6;(z) = 
i: fi) 


+ 6(z" — 1) (12.3) 


where f/(z) = £ fi (2), f; (x) € T(z) and the integer ô is defined by 


"T" 1 ifdeg(/f;(z)) is odd, 
~ |O otherwise. 


Let the decomposition of z” — 1 and its corresponding primitive idempotent be listed 
as follows: 


u(x) €i(z) ЛО) 
иә(х) 62(z) fo(x) 


d ө) ж. 


Неге и (х), и2(х),..., u; (x) are the binary idempotents whose Mattson-Solomon 
polynomials are 0; (z), 6» (2), . . . , 6; (z), respectively. Assume that % C (1,2, ..., t}, 
let the binary polynomials u(x) = Оуе-у ш (х), f(z) = [view fi(z), and 6(z) = 
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Оу 0i (2. It is apparent that, since и; (х) = М8! (0;(2)), u(x) = MS^! (0(2)) 
апа и(х) is ап idempotent.! 

Recall that u(x) is a low-weight binary idempotent whose reciprocal polynomial 
can be used to define the parity-check matrix of a cyclic LDPC code. The number of 
distinct n® roots of unity which are also roots of the idempotent u(x) determines the 
dimension of the resulting LDPC code. In this section, the design of cyclic LDPC 
codes is based on several important features of a code. These features, which are 
listed as follows, may be easily gleaned from the Mattson-Solomon polynomial of 
u(x) and the binary irreducible factors of z" — 1. 


1. Weight of the idempotent и(х) 
The weight of u(x) is the number of n roots of unity which are zeros of f(z). 
Note that, f (o^) = 0 if and only if 0 (o) = 1 since an idempotent takes only the 
values О and 1 over Fyn. If u(x) is written as ug + uix +++ - Бих", following 
(11.2), we have 


ш-б(о) (mod2) fori = (0, 1,...,n — 1}. 


Therefore, и; = 1 precisely when f (o^) = 0, giving мін (u(x)) as the degree of 
the polynomial f (z). 

2. Number of zeros of u(x) 
Following (11.1), it is apparent that the number of zeros of u(x) which are roots 
of unity, which is also the dimension of the code k, is 


Number of zeros of u(x) = k = n — wtg (0(z)). (12.4) 


3. Minimum Hamming distance bound 

The lower bound of the minimum Hamming distance of a cyclic code, defined 
by idempotent u(x), is given by its BCH bound, which is determined by the 
number of consecutive powers of a, taken cyclically (mod л), which are roots 
of the generating idempotent e, (x) = 1 + u(x). In the context of u(x), it is the 
same as the number of consecutive powers of о, taken cyclically (mod n), which 
are not roots of u(x). Therefore, it is the largest number of consecutive non-zero 
coefficients in 0 (2), taken cyclically (mod л). 


The method of finding f;(z) is well established and using the above information, 
a systematic search for idempotents of suitable weight may be developed. To be 
efficient, the search procedure has to start with an increasing order of wt н (u(x)) and 
this requires rearrangement of the set F such that deg( f; (z)) < deg( fii + 1(z)) for 
all i. It is worth mentioning that it is not necessary to evaluate u(x) by taking the 


I Since the Mattson-Solomon polynomial of a binary polynomial is an idempotent and vice-versa 
[20], the Mattson-Solomon polynomial of a binary idempotent is also a binary idempotent. 
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Mattson-Solomon polynomial of 0 (z), for each f (z) obtained. It is more efficient to 
obtain и(х) once the desired code criteria, listed above, are met. 

For an exhaustive search, the complexity is of order © (21% ') . A search algorithm, 
see Algorithm 12.2, has been developed and it reduces the complexity considerably by 
targeting the search on the following key parameters. Note that this search algorithm, 
which is constructed in the Mattson-Solomon domain, is not constrained to find 
cyclic codes that have girth at least 6. 


1. Sparseness of the parity-check matrix 
A necessary condition for the absence of cycles of length 4 is given by the inequal- 
ity wtg (u(x)) (мн (u(x)) — 1) < n — 1. Since му (и(х)) = deg( f (z)), a rea- 
sonable bound is 


> deg(/i2) < Vn. 


Vies 


In practise, this limit is extended to enable the finding of good cyclic LDPC codes 
which have girth of 4 in their underlying Tanner graph. 

2. Code rate 
The code rate is directly proportional to the number of roots of u(x). If Rmin 
represents the minimum desired code rate, then it follows from (12.4) that we can 
refine the search to consider the cases where 


wta (8(z)) € (1 — Rmin)n. 


3. Minimum Hamming distance 

If the idempotent и(х) is orthogonal on each position, then the minimum Ham- 
ming distance of the resulting code defined by u(x) is equal to 1 + мн (u(x)). 
However, for cyclic codes with cycles of length 4, there is no direct method to 
determine their minimum Hamming distance and the BCH bound provides a 
lower bound to the minimum Hamming distance. Let d be the lowest desired 
minimum Hamming distance and rg be the largest number of consecutive non- 
zero coefficients, taken cyclically, of 0(z). If a cyclic code has гө of d, then its 
minimum Hamming distance is at least 1 + d. It follows that we can further refine 
the search with the constraint 


т> d — 1. 


In comparison to the construction method described in Sect. 4.4, we can see that 
the construction given in Sect. 4.4 starts from the idempotent u(x), whereas this 
section starts from the idempotent 0 (z), which is the Mattson-Solomon polynomial 
of u(x). Both construction methods are equivalent and the same cyclic LDPC codes 
are produced. 
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Algorithm 12.2 MSCodeSearch(V, index) 
Input: 
V <a vector initialised to Й 
index <- an integer initialised to —1 
Rmin < minimum code rate of interest 
d « lowest expected minimum distance 
ô <= small positive integer 
F(z) = (fi(2)) Vi € I sorted in ascending order of the degree 
Об) = {6 (Z)} Vi e I 


Output: 
CodesList contains set of codes 
1::T<V 
2: for (izindex4l; і<|Ж; i++) do 
3: Тре = T 


4: if (Хут deg( fj (x)) + deg(fi(x)) < /n + à) then 
5: Append i to T 

6: 0(z) = Хуует09/ @) 

7 if (wta (6(2)) < (1 — Rmin)n and ro > d) then 

8 u(x) = MS^! (0(2)) 


9: if (и (x) is non-degenerate) then 
10: € <= a cyclic code defined by u(x) 
11: if (е ё CodeList) then 
12: Add С to CodeList 
13: end if 
14: end if 
15: end if 
16: MSCodeSearch(T, i) 

17: end if 
18: T € Tprev 
19: end for 


Some good cyclic LDPC codes with cycles of length 4 found using Algorithm 12.2, 
which may also be found using Algorithm 12.1, are tabulated in Table 12.2. A check 
based on Lemma 12.1 may be easily incorporated in Step 12 of Algorithm 12.2 to 
filter out cyclic codes whose Tanner graph has girth of 4. 

Figure 12.3 demonstrates the FER performance of several cyclic LDPC codes 
found by Algorithm 12.2. It is assumed that binary antipodal signalling is employed 
and the iterative decoder uses the RVCM algorithm described by Papagiannis 
et al. [23]. The FER performance is compared against the sphere packing lower 
bound offset for binary transmission. We can see that the codes [127, 84, 10] and 
[127, 99, 7], despite having cycles of length 4, are around 0.3 dB from the offset 
sphere packing lower bound at 107% FER. Figure 12.3c compares two LDPC codes 
of block size 255 and dimension 175, an algebraic code obtained by Algorithm 12.2 
and an irregular code constructed using the PEG algorithm [10]. It can be seen that, 
in addition to having improved minimum Hamming distance, the cyclic LDPC code 
is 0.4 dB superior to the irregular code, and compared to the offset sphere packing 
lower bound, it is within 0.25 dB away at 107^ FER. The effect of the error floor 
is apparent in the FER performance of the [341, 205, 6] irregular LDPC code, as 
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Table 12.2 Several good cyclic LDPC codes with girth of 4 


[л, К, d] и(х) 
[51, 26, 10] 1 x? | хб | x12 | х!7 } x24 } х27 | 34 } х39 x45 | x48 
[63, 44, 8] 1 x? | хі! x18 px?! -х22 px% х27 -х36 -х37 -х42 | х“ -х45 x50 Ex 
[117, 72, 12] 1 x4 x2 | x4 | x8 | хы | x16 | х22 | х32 | x^ | x59 | х64 | x88 
[127, 84, 10] 1+x -х2 | x4 x8 | x16 | 32 x?) і 59 -х04 х9! х93 px 109 px 110 px 118 
[127, 91, 10] 1 x2 x10 х18 x29 х3? х33 x49 x50 x4 x58 x65 
x4 x76 x78 x96 x87 x88 | x9? | х93 | х95 
[127, 92, 7] 1 х x10 x20 x29 х3! x33 x? x49 x58 no x06 
x78 x7? x90 x83 x 103 | х105 | x15 | x 116 | х121 } х124 
[127, 99, 7] 14 х! | x 16 p18 -х22 } х26 } х39 | x? } x45 1 46 | x49 } x? x65 -х08 | 
x70 } x78 } x90 | x90 | x?! | х92 | x96 x?7 } x 102 | x103 | x105 x108 | хі 
109 T T Т Cyclic LDPC code 10° Gyalic (БЕС code 
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Fig. 12.3 FER performance of some binary cyclic LDPC codes 


shown in Fig. 12.3d. The floor of this irregular code is largely attributed to minimum 
Hamming distance error events. Whilst this irregular code, at low SNR region, has 
better convergence than does the algebraic LDPC code of the same block length and 
dimension, the benefit of having higher minimum Hamming distance is obvious as 
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the SNR increases. The [341, 205, 16] cyclic LDPC code is approximately 0.8 dB 
away from the offset sphere packing lower bound at 107^ FER. 

It is clear that short block length (n < 350) cyclic LDPC codes have outstanding 
performance and the gap to the offset sphere packing lower bound is relatively close. 
However, as the block length increases, the algebraic LDPC codes, although these 
code have large minimum Hamming distance, have a convergence issue, and the 
threshold to the waterfall region is at larger Ер / No. The convergence problem arises 
because as the minimum Hamming distance increases, the weight of the idempotent 
u(x), which defines the parity-check matrix, also increases. In fact, if u(x) satisfies 
Lemma 12.1, we know that wty (u(x)) = d — 1, where d is the minimum Hamming 
distance of the code. Large values of мін (u(x)) result in a parity-check matrix that 
is not as sparse as that of a good irregular LDPC code of the same block length and 
dimension. 


12.2.2  Non-Binary Extension of the Cyclotomic Coset-Based 
LDPC Codes 


The code construction technique for the cyclotomic coset-based binary cyclic LDPC 
codes, which is discussed in Sect. 4.4, may be extended to non-binary fields. Similar 
to the binary case, the non-binary construction produces the dual-code idempotent 
which is used to define the parity-check matrix of the associated LDPC code. 

Let m and т” be positive integers with m | т”, so that Ёз» is a subfield of Fyn. 
Let n be a positive odd integer and F,» be the splitting field of x" — 1 over Ез", so 
that n|2" — 1. Letr = (2" — 1)/n,1 = (2" — 1)/(2" — 1), а be a generator for Fyn 
and В be a generator of Fy, where В = o. Let T, (x) be the set of polynomials of 
degree at most n — 1 with coefficients in IF». For the case of a = 1, we may denote 
Ti (x) by T (x) for convenience. 

The Mattson-Solomon polynomial and its corresponding inverse, (11.1) and 
(11.2), respectively, may be redefined as 


п—1 


A(z) = MS (a(x)) = У aa) z/ (12.5) 
j=0 
1 n-l "- 
a(x) = MS" (А0) = – У Aa") (12.6) 


i=0 


where а(х) € T,, (x) and A(z) € T, (z). 

Recall that a polynomial е(х) € Т (x) is termed an idempotent if the property 
e(x) = e(x)* (mod x" — 1) is satisfied. Note that e(x) z e(x?) (mod x" — 1) unless 
m = 1. The following definition shows how to construct ап idempotent for binary 
and non-binary polynomials. 
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Definition 12.9 (Cyclotomic Idempotent) Assume that “M be a set as defined in 
Sect. 4.4, let s € ./ and let C, ; represent the (i + 1)th element of C;, the cyclotomic 
coset of s (mod n). Assume that the polynomial e, (x) € Т (x) is given by 


aom СУ) gua (12.7) 


0<і<|С,|-1 


where |С, | is the number of elements іп С;. In order for e; (x) to be an idempotent, 
its coefficients may be chosen in the following manner: 


() ifm =1,ec,, = 1, 
(ii) otherwise, ec, , is defined recursively as follows: 


fori = 0, ес, € {1, В.В, В), 
fori > 0, ес, = CE 


We refer to the idempotent е, (x) as a cyclotomic idempotent. 


Definition 12.10 (Parity-Check Idempotent) Let @ С N and let u(x) € T, (x) be 


u(x) = > 8/00. (12.8) 


SEM 
The polynomial u(x) is an idempotent and it is called a parity-check idempotent. 


As in Sect. 4.4, the parity-check idempotent u(x) is used to define the Fam cyclic 
LDPC code over Fz», which may be denoted by [n, К, 4|р». The parity-check matrix 
consists of n cyclic shifts of x8) у(х !). For the non-binary case, the minimum 
Hamming distance d of the cyclic code is bounded by 


do + 1 <d<min(wty(g(x)), wtu (1 + и(х))), 


where do is the maximum run of consecutive ones in U (z) = MS(u(x)), taken 
cyclically mod n. 

Based on the description given above, a procedure to construct a cyclic LDPC 
code over Ез» is as follows. 


1. For integers т and n, obtain the splitting field (Fyn) of x" — 1 over Fam. Unless 
the condition of m | т” is satisfied, Е» cyclic LDPC code of length n cannot be 
constructed. 

2. Generate the cyclotomic cosets modulo 2" — 1 denoted as С”. 

3. Derive a polynomial p(x) from С” and let s € ./ be the smallest positive integer 
such that |C;| = m. The polynomial p(x) is the minimal polynomial of a’, 


pc) = [| (x + «©. (12.9) 


0xi «m 
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Construct all elements of Fam using p(x) as the primitive polynomial. 

4. Let C be the cyclotomic cosets modulo n and let -V be a set containing the 
smallest number in each coset of C. Assume that there exists a non-empty set 
M C N and following Definition 12.10 construct the parity-check idempotent 
u(x). The coefficients of u(x) can be assigned following Definition 12.9. 

5. Generate the parity-check matrix of @ using the n cyclic shifts of х4) и(х 1). 

6. Compute ғ and /, and then take the Mattson-Solomon polynomial of u(x) to 
produce U (z). Obtain the code dimension and the lower bound of the minimum 
Hamming distance from U (z). 


Example 12.3 Consider the construction of a n = 21 cyclic LDPC code over Ё». 
The splitting field of x?! — 1 over Fs is Fy, and this implies that m = т’ = 6, 
r = 3 and = 1. Let C and С” denote the cyclotomic cosets modulo п and 2” — 1, 
respectively. We know that |С! | = 6 and therefore the primitive polynomial p(x) has 
roots of o//, for all j € Cj, i.e. р(х) = 1 +x + x. By letting 1 + 6 + 8 = 0, all of 
the elements of Ев can be defined. If u(x) is the parity-check idempotent generated 
by the sum of the cyclotomic idempotents defined by С;, where s € {.2 : 5,7, 9} 
and ec,, for all s € be В??, 1 and 1, respectively, 


u(x) = В? +x! аА оа 4x44 x 4p +x” 


+ 8%х!? + pre 


and its Mattson-Solomon polynomial U (z) indicates that itis a [21, 15, > 5]5s cyclic 
code, whose binary image is а [126, 90, 8] linear code. 


The following systematic search algorithm is based on summing each possible 
combination of the cyclotomic idempotents to search for all possible Ез» cyclic codes 
of a given length. As in Algorithm 12.2, the search algorithm targets the following 
key parameters: 


1. Sparseness of the resulting parity-check matrix 
Since the parity-check matrix is directly derived from u(x) which consists of the 
sum of the cyclotomic idempotents, only low-weight cyclotomic idempotents are 
of interest. Let Wmax be the maximum мін (u(x)); then the search algorithm will 
only choose the cyclotomic idempotents whose sum has total weight less than or 
equal to Wmax. 

2. High code rate 
The number of roots of u(x) which are also roots of unity define the dimension 
of the resulting LDPC code. Let the integer kmin be defined as the minimum code 
dimension, and the cyclotomic idempotents that are of interest are those whose 
Mattson-Solomon polynomial has at least kmin zeros. 

3. High minimum Hamming distance 
Let the integer d' be the smallest value of the minimum Hamming distance of 
the code. The sum of the cyclotomic idempotents should have at least d' — 1 
consecutive powers of B which are roots of unity but not roots of u(x). 
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Table 12.3 Examples of [n, К, d]»» cyclic LDPC codes 
q [n, К] u(x) d Comment 
Fy |[51,29] B?x? + Bx® + В2х12 + p2x!7 4 Вх24 + | 95 10 m = 2, 
px” Bx? B2x?9 | Bx 9 82х48 m= 8, 
r = 5 апа 
1 = 85 
[255, 175] Bx! + B2x!4 + Bx + В2х26 + х1! + |217 |<20 |т-г2, 
Bx12 4 x! 2 131 4 4.183 4 189 m' = 8, 
Bx 193-1219.,.,222 4,82 4224 237 4 4246 ке ана 
1=85 
[273, 191] B2x?3 + Bx37 + Bx + В2х7* >18 |<20 |m=2, 
х9! 4 2,92 2,95 2,107 т! = 12, 
xl 4. gx 148... В2155 + g2,182 r — 15 and 
Bx184 4 px! + 4195 + Вх214 24 1- 1365 
F5: |[63,40] 1+ 82x? + Bx P + 3x18 + g2x19 + >6 10 m —3, 
p2x?6 64:36 ptx38 Вх“! Вх? т! = 6 
r = 1 and 
1= 9 
[63, 43] Bx? | px | ptx'8 x?! 4 28 <12 т = 3, 
В$х22 + 83х25 + x? + 8х6 + 85х37 4 m' = 6, 
x42 | px | x45 | В6х50 | x54 r= l and 
1= 9 
[91, 63] enda mediana 8%х°% + px? + |28  |<10 |m=3, 
Вх! р 85х23 182,426. 53,32 5437 т! = 12, 
px“ | pix” | B°x>! | 86х°* | Вх? г = 45 and 
1 = 585 
Ға | [85, 48] 1+ В!2х21 + 8°х# + pox + Вх + | >27 | <12 |т-4, 
Bx! + В!?х®! + 86х53 + 83х55 т! = 8, 
r — 3and 
1= 17 
Fs | (31, 20] 1+ В28х5 + g7y9 + В25х10 + х1 + |>7 12 т = 5, 
х13 + 814518 4 В19 20 21 22 26 т = 5, 
r = 1 and 
1= 1 
[31,21] Bx? 29,9 | 15,10 | Bx!! | >4 8 т = 5, 
4x13 4 g27.18 4 83020 4 В16521 4 m' = 5, 
B2x2 + В8х26 r = 1 and 
l=1 
Еж | (21, 15] BP x5 + x? + x9 + gt6x10 4 B8xB 4 |>5 8 m = 6, 
xl4 4 x5 + В53 17 4 418 4 85819 4 3i 6, 
829,20 r — 3and 
l=1 


“Тһе minimum Hamming distance of the binary image which has been determined using the improved Zimmermann 


algorithm, Algorithm 5.1 
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Following Definition 12.10 and the Mattson-Solomon polynomial 


Uc) =М${ У е0) |= ХЕ. 


SEM SEM 


it is possible to maximise the run of the consecutive ones in U(z) by varying the 
coefficients of e,(x). It is therefore important that all possible non-zero values of 
ес,, for all s € „4 are included to guarantee that codes with the highest possible 
minimum Hamming distance are found. 

Table 12.3 outlines some examples of [n, k, d]o» cyclic LDPC codes. The non- 
binary algebraic LDPC codes in this table perform well under iterative decoding as 
shown in Fig. 12.4 assuming binary antipodal signalling and the AWGN channel. 
The RVCM algorithm is employed in the iterative decoder. The FER performance 
of these non-binary codes is compared to the offset sphere packing lower bound in 
Fig. 12.4. 

As mentioned in Sect. 12.1.2, there is an inverse relationship between the conver- 
gence of the iterative decoder and the minimum Hamming distance of a code. The 
algebraic LDPC codes, which have higher minimum Hamming distances compared 
to irregular LDPC codes, do not converge well at long block lengths. It appears that 
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Fig. 12.4 FER performance of some non-binary cyclic LDPC codes 
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[5461,3781,<11], irregular PEG LDPC code 
[5461,3781,43], cyclic LDPC code 
Offset Sphere Packing Lower Bound 


Frame Error Rate (FER) 


Fig. 12.5 FER performance of algebraic and irregular LDPC codes of rate 0.6924 and code length 
5461 bits 


the best convergence at long code lengths can only be realised by irregular LDPC 
codes with good degree distributions. Figure 12.5 shows the performance of two 
LDPC codes of block length 5461 bits and code rate 0.6924; one is an irregular code 
constructed using the PEG algorithm and the other one is an algebraic code of mini- 
mum Hamming distance 43 based on cyclotomic coset and idempotent construction 
(see Table 12.1). These results are for the AWGN channel using binary antipodal 
signalling with a belief propagation iterative decoder featuring 100 iterations. We 
can see that at 107? FER, the irregular PEG code is superior by approximately 1.6 dB 
compared to the algebraic cyclic LDPC code. However, for short code lengths, alge- 
braic LDPC codes are superior. The codes have better performance and have simpler 
encoders than ad hoc designed LDPC codes. 


12.3 Irregular LDPC Codes from Progressive 
Edge-Growth Construction 


Itis shown by Hu et al. [11] that LDPC codes obtained using the PEG construction 
method can perform better than other types of randomly constructed LDPC codes. 
The PEG algorithm adds edges to each vertex such that the local girth is maximised. 
The PEG algorithm considers only the variable degree sequence, and the check degree 
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Fig. 12.6 Effect of vertex degree ordering in PEG algorithm 


sequence is maintained to be as uniform as possible. In this section, the results of 
experimental constructions of irregular LDPC codes using the PEG algorithm are 
presented. Analysis on the effects of the vertex degree ordering and degree sequences 
have been carried out by means of computer simulations. All simulation results in 
this section, unless otherwise stated, were obtained using binary antipodal signalling 
with the belief propagation decoder using 100 iterations. Each simulation run was 
terminated after the decoder had produced 100 erroneous frames. 

Figure 12.6 shows the FER performance of various [2048, 1024] irregular LDPC 
codes constructed using the PEG algorithm with different vertex degree orderings. 
These LDPC codes have variable degree sequence A; (x) = 0.475x? + 0.280x? + 
0.035x* + 0.109х> + 0.101x . Let (vo, vi, ..., Vi, ... , Vn 1) be a set of variable 
vertices of an LDPC code. Code 0 and Code 1 LDPC codes were constructed with 
an increasing vertex degree ordering, i.e. deg(vo) < deg(vi) <>... < 4ес(у, 1), 
whereas the remaining LDPC codes were constructed with random vertex degree 
ordering. 

Figure 12.6 clearly shows that, unless the degree ofthe variable vertices is assigned 
in an increasing order, poor LDPC codes are obtained. In random degree ordering of 
half rate codes, it is very likely to encounter the situation where, as the construction 
approaches the end, there are some low-degree variable vertices that have no edge 
connected to them. Since almost all of the variable vertices would have already had 
edges connected to them, the low-degree variable vertices would not have many 
choice of edges to connect in order to maximise the local girth. It has been observed 
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that, in many cases, these low-degree variable vertices are connected to each other, 
forming a cycle which involves all vertices, and the resulting LDPC codes often 
have a low minimum Hamming distance. If d variable vertices are connected to each 
other and a cycle of length 2d is formed, then the minimum Hamming distance of 
the resulting code is d because the sum of these d columns in the corresponding 
parity-check matrix Н is 07. 

In contrast, for the alternative construction which starts from an increasing degree 
of the variable vertices, edges are connected to the low-degree variable vertices 
earlier in the process. Short cycles, which involve the low-degree variable vertices 
and lead to low minimum Hamming distance, may be avoided by ensuring these low- 
degree variable vertices have edges connected to the parity-check vertices which are 
connected to high-degree variable vertices. 

It can be expected that the PEG algorithm will almost certainly produce poor 
LDPC codes if the degree of the variable vertices is assigned in descending order. It 
is concluded that all PEG-based LDPC codes should be constructed with increasing 
variable vertex degree ordering. 

Figure 12.7 shows the effect of low-degree variable vertices, especially A» and 
Хз. on the FER performance of various [512, 256] PEG-constructed irregular LDPC 
codes. Table 12.4 shows the variable degree sequences of the simulated irregular 
codes. Figure 12.7 indicates that, with the fraction of high-degree variable vertices 
kept constant, the low-degree variable vertices have influence over the convergence 
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Table 12.4 Variable degree sequences for codes in Fig. 12.7 
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Code л 24 

Code 0 0.150 0.100 
Code 1 0.200 0.100 
Code 2 0.250 0.100 
Code 3 0.300 0.100 
Code 4 0.350 0.100 
Code 5 0.400 0.100 
Code 6 0.450 0.100 
Code 7 0.500 0.100 
Code 8 0.550 0.100 
Code 10 0.150 0.100 
Code 11 0.200 0.100 
Code 12 0.250 0.100 
Code 13 0.300 0.250 0.300 0.050 0.100 
Code 14 0.350 0.100 0.400 0.050 0.100 
Code 20 0.150 0.000 0.700 0.050 0.100 
Code 21 0.200 0.100 0.550 0.050 0.100 
Code 22 0.250 0.200 0.400 0.050 0.100 
Code 23 0.300 0.300 0.250 0.050 0.100 
Code 24 0.350 0.400 0.100 0.050 0.100 


in the waterfall region. As the fraction of low-degree variable vertices is increased, 
the FER in the low signal-to-noise ratio (SNR) region improves. On the other hand, 
LDPC codes with a high fraction of low-degree variable vertices tend to have low 
minimum Hamming distance and as expected, these codes exhibit early error floors. 
This effect is clearly depicted by Code 7 and Code 8, which have the highest 
fraction of low-degree variable vertices among all the codes in Fig. 12.7. Of all of 
the codes, Code 6 and Code 24 appear to have the best performance. 

Figure 12.8 demonstrates the effect of high-degree variable vertices on the FER 
performance. These codes are rate 3/4 irregular LDPC codes of length 1024 bits 
with the same degree sequences, apart from their maximum variable vertex degree. 
One group has maximum degree of 8 and the other group has maximum degree of 
12. From Fig. 12.8, it is clear that the LDPC codes with maximum variable vertex 
degree of 12 converge better under iterative decoding than those codes with maximum 
variable vertex degree of 8. 

In a similar manner to Fig. 12.7, the effect of having various low-degree variable 
vertices 15 also demonstrated in Fig. 12.9. In this case, the LDPC codes are constructed 
to have the advantageous linear-time encoding complexity, where the parity symbols 
are commonly described as having a zigzag pattern [26]. In this case, А and А; of 
these LDPC codes are fixed and the effect of varying Аз, Ад and A5 is investigated. 
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Table 12.5 Variable degree sequences of LDPC codes іп Fig. 12.9 


12 LDPC Codes 


Code А À2 Аз Ад 25 Мо 

Соде 0 0.000625 0.249375 0.644375 0.105625 
Code 1 0.000625 0.249375 0.420000 0.224375 0.105625 
Соде 2 0.000625 0.249375 0.195000 0.449375 0.105625 
Code 3 0.000625 0.249375 0.420000 0.224375 0.105625 
Code 4 0.000625 0.249375 0.195000 0.449375 0.105625 
Code 5 0.000625 0.249375 0.420000 0.111875 0.111875 0.106250 
Code 6 0.000625 0.249375 0.195000 0.224375 0.224375 0.106250 
Code 7 0.000625 0.249375 0.420000 0.224375 0.105625 
Code 8 0.000625 0.249375 0.195000 0.449375 0.105625 
Code 9 0.000625 0.249375 0.449375 0.195000 0.105625 
Code 10 0.000625 0.249375 0.449375 0.097500 0.097500 0.105625 
Code 11 0.000625 0.249375 0.449375 0.044375 0.150000 0.106250 
Code 12 0.000625 0.249375 0.495000 0.150000 0.105000 
Code 13 0.000625 0.249375 0.495000 0.075000 0.075000 0.105000 
Code 14 0.000625 0.249375 0.495000 0.037500 0.111875 0.105625 
Code 15 0.000625 0.249375 0.570000 0.075000 0.105000 
Code 16 0.000625 0.249375 0.570000 0.037500 0.037500 0.105000 
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The variable degree sequences of the LDPC codes under investigation, which are 
rate 3/4 codes of length 1600 bits, are depicted in Table 12.5. The results show that, 
as in the previous cases, these low-degree variable vertices contribute to the waterfall 
region of the FER curve. The contribution of А; is more significant than that of А; 
and this may be observed by comparing the FER curves of Code 1 with either Code 
3 or Code 4, which has Аз of 0.0. We can also see that Code 0, which has the most 
variable vertices of low degree, exhibits a high error floor. 

In contrast to Fig. 12.9, Fig. 12.10 shows the effect of varying high-degree variable 
vertices. The LDPC codes considered here all have the same code rate and code length 
as those in Fig. 12.9 and their variable degree sequences are shown in Table 12.6. The 
results show that 


The contribution of the high-degree variable vertices is in the high SNR region. 
Consider Code 10 to Code 33, those LDPC codes that have larger А2 tend to 
be more resilient to errors in the high SNR region than those with smaller 415. At 
E/N, = 3.0 dB, Code 10, Code 11 and Code 12 are inferior to Code 13 and 
similarly, Code 23 and Code 33 have the best performance in their group. 
Large values of maximum variable vertex degree may not always lead to improved 
FER performance. For example, Code 5 and Code 6 do not perform as well as 
Code 4 at E/N, = 3.0 dB. This may be explained as follows. As the maximum 
variable vertex degree is increased, some of the variable vertices have many edges 
connected to them, in the other words the corresponding symbols are checked 
by many parity-check equations. This increases the chances of having unreliable 
information from some of these equations during iterative decoding. In addition, a 
larger maximum variable vertex degree also increases the number of short cycles 
in the underlying Tanner graph of the code. It was concluded also by McEliece 
et al. [22] and by Etzion et al. [7] that short cycles lead to negative contributions 
preventing the convergence of the iterative decoder. 


12.4 Quasi-cyclic LDPC Codes and Protographs 


Despite irregular LDPC codes having lower error rates than their regular counter- 
parts, Luby et al. [18], the extra complexity of the encoder and decoder hardware 
structure, has made this class of LDPC codes unattractive from an industry point 
of view. In order to encode an irregular code which has a parity-check matrix H, 
Gaussian elimination has to be done to transform this matrix into reduced echelon 
form. Irregular LDPC codes, as shown in Sect. 12.3, may also be constructed by 
constraining the п — К low-degree variable vertices of the Tanner graph to form a 
zigzag pattern, as pointed out by Ping et al. [26]. Translating these n — k variable 
vertices of the Tanner graph into matrix form, we have 
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11 
Н,-| :: (12.10) 
11 
11 


The matrix H , is non-singular and the columns of this matrix may be used as the 
coordinates of the parity-check bits of an LDPC code. 

The use of zigzag parity checks does simplify the derivation of the encoder as the 
Gaussian elimination process is no longer necessary and encoding, assuming that 


H — CALA 
vo vi ee Vk—2 Vk—1 Vk Vk+1 +++ Vn—2 Vn-1 
U0,0 Hol e. UO,k-2 uok-1 |1 
И1,0 Ирр... Шә ирк |1 d 
= 9 
Un—k—2,0 Un—k—-2,1 «++ Ип—к—2,&—2 Un—k—2,k-1 1 1 
Un—k—1,0 Un—k-1,1 «++ Un—k—1,k—2 Ип—К—1,К—1 1 1 


can be performed by calculating parity-check bits as follows: 


k-1 
Ve = o viuo; (mod 2) 
ј=0 
k-1 
vi =v +È vno (mod2) fork+1<i<n-1. 
j=0 


Nevertheless, zigzag parity bit checks do not lead to a significant reduction in encoder 
storage space as the matrix Н, still needs to be stored. It is necessary to introduce 
additional structure in Н,, such as using a quasi-cyclic property, to reduce signifi- 
cantly the storage requirements of the encoder. 


12.4.1 Quasi-cyclic LDPC Codes 


Quasi-cyclic codes have the property that each codeword is a m-sized cyclic shift 
of another codeword, where m is an integer. With this property simple feedback 
shift registers may be used for the encoder. This type of code is known as circulant 
codes defined by circulant polynomials and depending on the polynomials can have 
significant mathematical structure as described in Chap. 9. A circulant matrix is a 
square matrix where each row is a cyclic shift of the previous row and the first row 
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is the cyclic shift of the last row. In addition, each column is also a cyclic shift of the 
previous column and the column weight is equal to the row weight. 

A circulant matrix is defined by a polynomial r(x). If r(x) has degree <m, the 
corresponding circulant matrix is an m x m square matrix. Let R be a circulant matrix 
defined by r (x), then M is of the form 


r(x) (mod x" — 1) 
xr(x) (mod x" — 1) 


xir(x) (mod x" — 1) (12.11) 


x"-lr(x) (mod x" — 1) 


where the polynomial in each row can be represented by an m-dimensional vector, 
which contains the coefficients of the corresponding polynomial. А quasi-cyclic code 
can be built from the concatenation of circulant matrices to define the generator or 
parity-check matrix. 


Example 12.4 А quasi-cyclic code with defining polynomials rı (x) = 1 + x + x? 
and гә(х) = 1--х24-х5, where both polynomials have degree less than the maximum 
degree of 6, produces a parity-check matrix in the following form: 


11010001010010 
01101000101001 
00110101010100 
Н - | 00011010101010 
10001100010101 
01000111001010 
1010001/0100101 


Definition 12.11 (Permutation Matrix) A permutation matrix is a type of circulant 
matrix where each row or column has weight of 1. A permutation matrix, which is 
denoted by Р„ ;, has r(x) = x/ (mod x" — 1) as the defining polynomial and it 
satisfies the property that p j^ Im, where Im is an m x m identity matrix. 


Due to the sparseness of the permutation matrix, these are usually used to construct 
quasi-cyclic LDPC codes. The resulting LDPC codes produce a parity-check matrix 
in the following form: 


P о, Ру. бл ... Pin. ова 


Р.о, Poo, ... Рома 
Н- 1 f | ; (12.12) 


Р,,0,10 Pm, Os Sry Pm, 0,1,2 
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From (12.12), we can see that there exists a s x 1 matrix, denoted by O, in H. 
This matrix is called an offset matrix and it represents the exponent of r(x) in each 
permutation matrix, i.e. 


Ооо Оо ... 00-1 


Oio Оц... Oii 
О- : . . : 


Os—1,0 О-11.-. Os 14-1 


where 0 < O;,; x m—1,for0 x i < s-land0 x j < t—1.The permutation matrix 
P m,j has m rows and m columns, and since the matrix Н contains s and t of these 
matrices per row and column, respectively, the resulting code is a [mt, m(t — s), d] 
quasi-cyclic LDPC code over F3. 

In general, some of the permutation matrices Р; j in (12.12) may be zero matrices. 
In this case, the resulting quasi-cyclic LDPC code is irregular and O;,; for which 
Р; ; = О may be ignored. If none of the permutation matrices in (12.12) is a zero 
matrix, the quasi-cyclic LDPC code defined by (12.12) is a (s, t) regular LDPC code. 


12.4.2 Construction of Quasi-cyclic Codes 
Using a Protograph 


A protograph is a miniature prototype Tanner graph of arbitrary size, which can be 
used to construct a larger Tanner graph by means of replicate and permute operations 
as discussed by Thorpe [32]. A protograph may also be considered as an [n’, k’] linear 
code 2? of small block length and dimension. A longer code may be obtained by 
expanding code Y by an integer factor О so that the resulting code has parameter 
[n = п' О, k = К Q] over the same field. A simplest way to expand code апа also 
to impose structure in the resulting code is by replacing a non-zero element of the 
parity-check matrix of code Y with a О x О permutation matrix, and a zero element 
with a О x О zero matrix. As a consequence, the resulting code has a quasi-cyclic 
structure. The procedure is described in detail in the following example. 


Example 12.5 Consider a code 2 = [4, 2] over IF? as a protograph. The parity- 
check matrix of code F is given by 


Vo V1 V2 V3 


, c [1 10 1| (12.13) 
meal 3344 


Let the expansion factor Q — 5, the expanded code, which is a [20, 10] code, has a 
parity-check matrix given by 
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VoVi V2 УЗ v4 VS V6 V7 V8 V9 VIO VI1 VI2VI3 V14 V15 V16 V17V18 V19 
coll 1 1 
al 1 1 1 


сз 1 1 1 


Cs 1 1 1 
c6 1 1 1 
с] 1 1 1 


C9 1 1 1 
(12.14) 


where the zero elements have been omitted. This protograph construction may also 
be described using the Tanner graph representation as shown in Fig. 12.11. 

Initially, the Tanner graph of code 22 is replicated Q times. The edges of these 
replicated Tanner graphs are then permuted. The edges may be permuted in many 
ways and in this particular example, we want the permutation to produce a code which 
has quasi-cyclic structure. The edges shown in bold in Fig. 12.11 or equivalently the 
non-zeros shown in bold in (12.14) represent the code Y. 

The minimum Hamming distance of code Y is 2 and this may be seen from its 
parity-check matrix, (12.13), where the summation of two column vectors, those of 
ут and уз, produces а zero vector. Since, in the expansion, only identity matrices are 
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Fig. 12.11 Code construction using a protograph 
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employed, the expanded code will have the same minimum Hamming distance as the 
protograph code. This is obvious from (12.14) where the summation of two column 
vectors, those of vs and ут, produces a zero vector. In order to avoid the expanded 
code having low minimum Hamming distance, permutation matrices may be used 
instead and the parity-check matrix of the expanded code is given by (12.15). 


vovi V2 V3 V4 У5У6 V7 V8 V9 VIO VI1VI2V13 V14 У15 V16V17V18 V19 


co 
с 1 1 1 


сз |1 1 1 


% 1 1 1 
с] 1 1 1 
Cg 1 1 1 


(12.15) 


The code defined by this parity-check matrix has minimum Hamming distance of 3. 
In addition, the cycle structure of the protograph is also preserved in the expanded 
code if only identity matrices are used for expansion. Since the protograph is such a 
small code, the variable vertex degree distribution required to design a good target 
code, which has much larger size than a protograph does, in general, causes many 
inevitable short cycles in the protograph. Using appropriate permutation matrices in 
the expansion, these short cycles may be avoided in the expanded code. 


In the following, we describe a construction of a long quasi-cyclic LDPC code for 
application in satellite communications. The standard for digital video broadcasting 
(DVB), which is commonly known as DVB-S2, makes use of a concatenation of 
LDPC and BCH codes to protect the video stream. The parity-check matrices of 
DVB-S2 LDPC codes contain a zigzag matrix for the n — К parity coordinates and 
quasi-cyclic matrices on the remaining k coordinates. In the literature, the code with 
this structure is commonly known as the irregular repeat accumulate (IRA) code [12]. 

The code construction described below, using a protograph and greedy PEG 
expansion, is aimed at improving the performance compared to the rate 3/4 DVB-S2 
LDPC code of block length 64800 bits. Let the [64800, 48600] LDPC code that we 
will construct be denoted by 41. A protograph code, which has parameter [540, 405], 
is constructed using the PEG algorithm with a good variable vertex degree distribu- 
tions obtained from Urbanke [34], 


Aj, (x) = 0.00185185x + 0.248148x? +0.55x7 + 0.0592593x° 
——————— 
for zigzag matrix 


+ 0.0925926x* + 0.00555556x ? + 0.00185185x ? + 0.0166667х!” 
+ 0.00185185х2* + 0.00185185x75 + 0.0203704х°°. 
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The constructed [540, 405] protograph code has a parity-check matrix Н’ = |Н” | 
Н] where Н, is a 135 х 135 zigzag matrix, see (12.10), and Н, is an irregular 
matrix satisfying Л, (x) above. In order to construct a |64800, 48600] LDPC code 
©, we need to expand the protograph code by a factor of О = 120. In expanding 
the protograph code, we apply the greedy approach to construct the offset matrix 
О in order to obtain a Tanner graph for the |64800, 48600] LDPC code “41, which 
has local girth maximised. This greedy approach examines all offset values, from 
0 to Q — 1, and picks an offset that results in highest girth or if there is more than 
one choice, one of these is randomly chosen. А 16200 x 48600 matrix Н, can be 
easily constructed by replacing a non-zero element at coordinate (i, j) in Н” with а 
permutation matrix Ро, о, ,. The resulting LDPC code Ф| has a parity-check matrix 
given by H = [H, | H „|, where, as before, Н , is given by (12.10). 

In comparison, the rate 3/4 LDPC code of block length 64800 bits specified in the 
DVB-S2 standard takes a lower Q value, О = 45. The protograph is а [1440, 1080] 
code which has the following variable vertex degree distributions 


Aj, (х) = 0.000694х + 0.249306x? + 0.666667x? + 0.083333x "^. 
——————— 


for zigzag matrix 


For convenience, we denote the DVB-S2 LDPC code by $65. 
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Fig. 12.12 FER performance of the DVB-S2 and the designed |64800, 48600] LDPC codes 
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Figure 12.12 compares the FER performance of @ and %2 using the belief propa- 
gation decoder with 100 iterations. Binary antipodal signalling and AWGN channel 
are assumed. Note that, although the outer concatenation of BCH code is not used, 
there is still no sign of an error floor at FER as low as 1076 which means that the 
BCH code is no longer required. It may be seen from Fig. 12.12 that the designed 
LDPC code, which at 107? FER performs approximately 0.35 dB away from the 
sphere packing lower bound offset for binary transmission loss, is 0.1 dB better than 
the DVB-S2 code. 


12.5 Summary 


The application of cyclotomic cosets, idempotents and Mattson-Solomon polynomi- 
als has been shown to produce many binary cyclic LDPC codes whose parity-check 
equations are orthogonal in each position. Whilst some of these excellent cyclic codes 
have the same parameters as the known class of finite geometry codes, other codes 
are new. A key feature of this construction technique is the incremental approach 
to the minimum Hamming distance and the sparseness of the resulting parity-check 
matrix of the code. Binary cyclic LDPC codes may also be constructed by consid- 
ering idempotents in the Mattson-Solomon domain. This approach has provided a 
different insight into the cyclotomic coset-based construction. It has also been shown 
that, for short algebraic LDPC codes, the myths of codes which have cycles of length 
4in their Tanner graph do not converge well with iterative decoding is not necessarily 
true. It has been demonstrated that the cyclotomic coset-based construction can be 
easily extended to produce good non-binary algebraic LDPC codes. 

Good irregular LDPC codes may be constructed using the progressive edge- 
growth algorithm. This algorithm adds edges to the variable and check vertices in 
a way that maximises the local girth. Many code results have been presented show- 
ing the effects of choosing different degree distributions. Guidelines are given for 
designing the best codes. 

Methods of producing structured LDPC codes, such as those which have quasi- 
cyclic structure, have been described. These are of interest to industry due to the 
simplification of the encoder and decoder. An example of such a construction to 
produce a (64800, 48600) LDPC code, using a protograph, has been presented along 
with performance results using iterative decoding. Better results are obtained with 
this code than the (64800, 48600) LDPC code used in the DVB-S2 standard. 
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Part ПІ 
Analysis апа Decoders 


This part is about the analysis of codes in terms of their codeword and stopping 
set weight spectrum and various types of decoders. Decoders are described, which 
include hard and soft decision decoders for the AWGN channel and decoders for the 
erasure channel. Universal decoders are discussed, which are decoders that can be 
used with any linear code for hard or soft decision decoding. One such decoder is 
based on the Dorsch decoder and this is described in some detail together with its 
performance using several different code examples. Other decoders such as the itera- 
tive decoder require sparse parity-check matrices and codes specifically designed for 
this type of decoder. Also included in this part is a novel concatenated |и|и + v| code 
arrangement featuring multiple near maximum likelihood decoders for an optimised 
matching of codes and decoders. With some outstanding codes as constituent codes, 
the concatenated coding arrangement is able to outperform the best LDPC and turbo 
coding systems with the same code parameters. 


Chapter 13 
An Exhaustive Tree Search for Stopping 
Sets of LDPC Codes 


13.1 Introduction and Preliminaries 


The performance of all error-correcting codes is determined by the minimum Ham- 
ming distance between codewords. For codes which are iteratively decoded such as 
LDPC codes and turbo codes, the performance of the codes for the erasure channel is 
determined by the stopping set spectrum, the weight (and number) of erasure patterns 
which cause the iterative decoder to fail to correct all of the erasures. Codes which 
perform poorly on the erasure channel do not perform well on the AWGN channel. 
To determine all of the stopping sets of a general (n, k) code is a prohibitive task, for 
example, a binary (1000, 700) code would require evaluation of 21900 possible stop- 
ping sets. It should be noted by the reader that all codewords are also stopping sets, 
but most stopping sets are not codewords. Fortunately the properties of particular 
types of codes may be used to reduce considerably the scale of the task, and in par- 
ticular codes with sparse parity-check matrices such as LDPC codes and turbo codes 
are amenable to analysis in practice. As the tree search is exhaustive, the emphasis 
is first on focusing the search so that only low-weight stopping sets are found, up to 
a specified weight, and second the emphasis is on the efficiency of the algorithms 
involved. 

In alandmark paper in 2007, Rosnes and Ytrehus [7] showed that exhaustive, low- 
weight stopping set analysis of codes whose parity-check matrix is sparse is feasible 
using a bounded tree search over the length of the code with no distinction between 
information and parity bits. A previous paper on the same topic of an exhaustive 
search of stopping sets of LDPC codes by Wang et al. [2] used a different and much 
less efficient algorithm. In common with this earlier research, we use similar notation 
in the following preliminaries. 

The code @ is defined to be binary and linear of length п and dimension К and is a 
k-dimensional subspace of (0, 1)", and may be specified as the null space of a m x n 
binary parity-check matrix H of rank n — k. The number of parity-check equations, 
m of Н satisfies m > (n — К), although there are, of course, only n — k independent 
parity-check equations. It should be noted, as illustrated in the results below, that the 
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number of parity-check equations т in excess of n — К can have a dramatic effect on 
the stopping set weight spectrum, excluding codewords of course, as these are not 
affected. 

As in [7], Z is used to denote a subset of (0, 1)”, the set of all binary vectors of 
length n. At any point in the tree search, a constraint set, ¥ is defined consisting of 
bit positions p; and the states of these bit positions 8р;,8р; € (0, 1)”. The support set 
X (7) of the constraint set, F , is the set of positions where sp ; = 1, and the Hamming 
weight of F is the number of such positions. The sub-matrix Н, 7, consists of all 
the columns of H where s pi = 1, and the row weight of Н, (уі the number of T's 
in that row. An active row of H, (т) is a row with unity row weight. It is obvious 
that if all rows ОЁН, я) have even row weight then F is a codeword, noting that 
for an iterative decoder codewords are also stopping sets. If at least one row has odd 
weight, 3 or higher and there are no active rows then .Z is a stopping set but not a 
codeword. If there are active rows then F has either to be appended with additional 
bit positions or one or more states sp; need to be changed to form a stopping set. With 
this set of basic definitions, tree search algorithms may be described which carry out 
an exhaustive search of (0, 1)" using a sequence of constraints F to find all stopping 
sets whose Hamming weight is < т. 


13.2 An Efficient Tree Search Algorithm 


At any given point in the search, the constraint set F is used to represent the set of 
searched known bits (up to this point) of a code @, which forms a branch of the tree 
in the tree search. The set of active rows in Н is denoted by (Do, ..., 55.1), where ф 
is the total number of active rows. A constraint set F with size n is said to be valid 
if and only if there exists no active rows in НХ. In which case the constraint set 
is equal to a stopping set. The pseudocode of one particularly efficient algorithm to 
find all the stopping sets including codeword sets with weight equal to or less than т 
is given in Algorithm 13.1 below. Each time a stopping set is found, it is stored and 
the algorithm progresses until the entire 2" space has been searched. 

The modified iterative decoding is carried out on a n-length binary input vector 
containing erasures in some of the positions. Let r;(F) be the rank (ones) of row 
j, j € (0,..., m — 1} for the constrained position (p; : (pi, 1) € F} intersected 
by row j on H. And let rj (Е) be the rank of row j for the unconstrained position 
{pi : (pi, 1) € (0, ..., n — 1}\ F} intersected by row j on Н. The modified iterative 
decoding algorithm based on belief-propagation decoding algorithm over the binary 
erasure channel is shown in Algorithm 13.2. As noted in the line with marked (%), 
the modified iterative decoder is not invoked if the condition of r; < 1 and rj = ] 
is not met; ог the branch with constraint set Ғ has condition of r; = 1 and rj = 0. 
This significantly speeds up the tree search. As noted in the line with marked (%), 
the modified iterative decoder is not necessary to call, if the condition of r; < 1 and 
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Algorithm 13.1 Tree search based Stopping Set Enumeration (TSSE) 


repeat 
Pick one untouched branch as a constraint set F. 
if |F| = n and w(F) < т then 
Constraint set F is saved, if F is valid 
else 
1). Pass F to the modified iterative decoder (*) with erasures in the unconstrained positions. 
2). Construct a new constraint set F’ with new decoded positions, which is the extended 
branch. 
if |F’| =n and w(F’) < т then 
Constraint set Е” is saved, if F' is valid 
else if No contradiction is found in H^, and и (Е) < т then 
а). Pick an unconstrained position p. 
b). Extending branch F’ to position p to get new branch F” = F’  J((p, 1)) and branch 
Е"! = F' UJ((. 0). 
end if 
end if 
until Tree has been fully explored 


Algorithm 13.2 Modified Iterative Decoding 


Get rank r(F) and r’(F) for all the equation rows on Н. 
repeat 
if rj > 1 then 
Row j is flagged 
else if r; = 1 and r5 — 0 then 
Contradiction — Quit decoder 
else if ғ; < 1 andr’, = 1 then 
1). Row / is flagged 
2). The variable bit i is decoded as the ХОК of the value of rj. 
3). Update the value of r; and rs if Hj; — 1. 
end if 
until No new unconstrained bit is decoded 


rj = | is not met; or the branch with constraint set F can be ignored, if condition 
of r; = 1 and rj — 0 occurs. Thus the computing complexity can be significantly 
reduced than calling it for every new branch with the corresponding constraint set Ғ. 


13.2.1 An Efficient Lower Bound 


The tree search along the current branch may be terminated if the weight necessary 
for additional bits to produce a stopping set plus the weight of the current constraint 
set F exceeds r. Instead of actually evaluating these bits, it is more effective to 
calculate a lower bound on the weight of the additional bits. The bound uses the 
active rows J (F) = {I (F), ..., Ii, (F)}, where Ij, (F) is the set of active rows 
with constraint set F corresponding to the ioth column hj, of Н, and q is the number 
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Table 13.3 WiMax 2/3A LDPC Codes 


і | Smin | №, Ns ul Nsnin+2 Nsmin+3 Nsmint4 | Nsmin+5 | Nsmin+6 
13 |15 76(76) 228(152) |0 0 0 0 0 
14 | 14 80(0) 80(80) 160(0) 0 0 0 0 
15| 15 | 84(84) | 252(0) 0 0 0 0 0 
16 | 15 |88(88) | 0(0) 0 0 0 0 0 
17| 15 92(92) 0(0) 92(92) 460(276) | Q 0 0 
18 | 15 96(96) 0(0) 96(96) 480(384) | 0 0 0 


Table 13.4 WiMax 2/3В LDPC Codes 


i Smin | Ns, Nsmin-+1 М „+2 Nsnin-+3 Nomin+4 No min +5 N5nin +6 
6 | 16 96(48) 432(48) 0 0 0 0 0 
7. 15 52(52) 0(0) 104(104) 156(104) 728(312) 2041(533) | 0 
8 16 63(63) 56(56) 196(56) 560(168) 1568(196) | 0 0 
9 |17 1200660 | O 0 0 0 0 0 
10 | 15 64(64) 0(0) 0(0) 0(0) 128(0) 384(64) 0 
11 | 18 204(68) | O 0 0 0 0 0 
12 | 15 72(72) 0(0) 0(0) 72(0) 0 0 0 
13 |15 76(76) 0(0) 0(0) 0(0) 0(0) 76(0) 0 
14 | 16 80(80) 80(0) 0 0 0 0 0 
15 | 15 84(84) 0(0) 0(0) 0(0) 84(84) 294(168) 0 
16 | 16 88(88) 88(0) 0 0 0 0 0 
17 | 20 92(92) 92(0) 92(0) 0 0 0 0 
18 | 15 96(96) 0(0) 0(0) 0(0) 0(0) 144(96) 0 
І.Е) 


of intersected unknown bits. Let w(h; ` `) be the weight of ones on jth column of 
Н, which is the number of active rows intersected with jth column. Under a worst 
case assumption, the 7;(F) with larger column weight of ones on jth column is 
always with value 1, then the active rows can be compensated by 1;(Ғ) and the total 


number of active rows $ is reduced by w(hj e until ф < 0. Algorithm 13.3 shows 


the pseudocode of computing the smallest number of intersected unknown bits q in 
order to produce no active rows. The lower bound w'(F) = w(F) + q is the result. 


Algorithm 13.3 Simple method to find the smallest collection set of active rows 


І. Arrange the set of J (F) in descending order, where hy is the column with the maximal column 
weight corresponding to constraint Ғ. 
2.4 is initialised as 0. 
while ф > 0 do 
1). ф is subtracted by wh). 
2). q is accumulated by 1. 
end while 
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Table 13.5 WiMax 3/4A LDPC Codes 

i | Smin | Nsmin Nsmint! Nsmin+2 Nsmin+3 Nsmint4 | Nsmin+5 | Nsmin+6 

6 10 48(0) 0(0) 24(0) 240(48) 624(288) 0 0 

т |12 26(0) 156(52) 260(104) 2184416 |0 0 0 

8 | 12 28(0) 112(0) 224(168) 952(280) 0 0 0 

9 12 90(60) 60(0) 180(60) 372(192) 0 0 0 

п | 12 34(0) 68(68) 0(0) 0(0) 0 0 0 

12 | 12 36(0) 0(0) 0(0) 0(0) 72(0) 504044) |0 

13 | 12 38(0) 76(76) 0(0) 76(76) 0 0 0 

14 | 12 40(0) 80(0) 160(0) 240(0) 240(0) 8000060) | O 

15 | 12 42(0) 0(0) 0(0) 0(0) 0(0) 168(84) 0 

16 | 12 44(0) 0(0) 0(0) 88(88) 0 0 0 

17 | 12 46(0) 0(0) 0(0) 0(0) 0(0) 0(0) 0 

18 | 12 48(0) 0(0) 0(0) 0(0) 0(0) 0(0) 96(0) 
Table 13.6 WiMax 3/4B LDPC Codes 

i Smin | Nsmin Мұны Nsmin+2 Nsmin+3 М, Ns in ^5 Nsmin+6 

7 9 52(52) 52(52) 52(52) 312(156) 988(416) 3094(1274) | 11180(3952) 

8 12 560(392) | 616(224) 1792(616) 7784(2968) 0 0 0 

9 10 60(60) 60(60) 130(10) 540(240) 2190(810) 7440(2940) | 0 

10 | 11 64(64) | 128(128) 128(64) 960(640) 3648(1408) | 0 0 

11 13 2720204) | 748(544) 2992(1564) 0 0 0 0 

12 | 12 72(0) 576(432) 576(216) 25209036) |0 0 0 

13: | 12 228(228) | 380(304) 988(836) 2888(836) 0 0 0 

14 | 10 80(80)0 | 000) 0(0) 0(0) 640(480) 24161216) | 0 

15 | H 84(0) 84(84) 336(168) 546(294) 1260(588) 0 0 

16 | 14 176(88) | 968(792) 0 0 0 0 0 

17 | 13 184(92) | 92(92) 1012(644) 0 0 0 0 

18 | 12 16(16) 96(96) 672(480) 0 0 0 0 


13.2.2 Best Next Coordinate Position Selection 


In the evaluation of the lower bound above, the selected unconstrained positions 
are assumed to have value 1. Correspondingly, the first position in the index list 
has maximal column weight and is the best choice for the coordinate to add to the 


constraint set F. 
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Table 13.7 Weight Spectra and stopping set spectra for the WiMax LDPC Codes [1] 
Code Length N = 576 + 96i 


i 0 1 2 3 4 5 6 7 8 9 
N 576 | 672 | 768 | 864 | 960 | 1056 | 1152 | 1248 | 1344 1440 
Code Rate Minimum Codeword Weight dm 
1/2 13 19 20 19 19 21 19 22 23 27 
2/3A 10 9 8 11 13 10 14 13 14 13 
2/3В 12 11 14 16 15 15 16 15 16 17 
3/4А 10 10 10 12 12 13 13 13 14 12 
3/4В 8 8 9 11 11 9 11 9 12 10 
5/6 5 7 7 7 7 7 7 7 7 7 
Minimum Stopping Set Weight sm 
1/2 18 18 18 21 19 19 24 19 24 24 
2/3A 10 10 11 9 12 13 13 14 14 14 
2/3B 10 12 13 15 14 16 16 18 18 17 
3/4A 9 8 10 11 12 12 10 12 12 12 
3/4В 10 10 10 11 11 11 12 12 12 
5/6 6 7 7 7 7 7 9 7 8 
Code Length N = 576 + 96i 
i 10 11 12 13 14 15 16 17 18 
N 1536 | 1632 | 1728 | 1824 | 1920 | 2016 | 2112 | 2208 | 2304 
Code Rate Minimum Codeword Weight dm 
1/2 20 27 21 19 25 27 28 23 31 
2/3A 12 13 15 15 15 15 15 15 15 
2/3B 15 18 15 15 16 15 16 20 15 
3/4A 14 13 17 13 17 17 15 20 19 
3/4B 11 13 13 12 10 12 14 13 12 
5/6 7 7 8 8 7 7 8 8 9 
Minimum Stopping Set Weight sm 
1/2 24 28 28 28 25 29 29 28 28 
2/3A 15 12 14 16 14 16 17 18 18 
2/3B 19 18 18 20 17 20 17 21 20 
3/4А 12 12 12 12 12 12 12 12 12 
3/4В 13 13 12 13 14 11 14 13 15 
5/6 8 9 7 9 7 8 9 8 10 


13.3 Results 


The algorithms above have been used to evaluate all of the low-weight stopping 
sets for some well-known LDPC codes. The results are given in Table 13.1 together 
with the respective references where details of the codes may be found. The total 
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number of stopping sets are shown for a given weight with the number of codewords 
in parentheses. Interestingly, the Tanner code has 93 parity-check equations, 2 more 
than the 91 parity-check equations needed to encode the code. If only 91 parity-check 
equations are used by the iterative decoder there is a stopping set of weight 12 instead 
of 18 which will degrade the performance of the decoder. The corollary of this is that 
the performance of some LDPC codes may be improved by introducing additional, 
dependent, parity-check equations by selecting low-weight codewords of the dual 
code. A subsequent tree search will reveal whether there has been an improvement 
to the stopping sets as a result. 


13.3.1 WiMax LDPC Codes 


WiMax LDPC codes [1], as the IEEE 802.16e standard LDPC codes, have been 
fully analysed and the low-weight stopping sets for all combinations of code rates 
and lengths have been found. Detailed results for WiMax LDPC codes of code rates 
1/2,2/3A,2/3B,3/4A, 3/4B are given in Tables 13.2, 13.3, 13.4, 13.5, 13.6. In these 
tables, the code index i is linked to the code length N by the formula N = 576+ 96i. 
The minimum weight of non-codeword stopping sets (Sm) and codeword stopping 
sets (dm) for all WiMax LDPC codes is given in Table 13.7. 


13.4 Conclusions 


An efficient algorithm has been presented which enables all of the low weight stop- 
ping sets to be evaluated for some common LDPC codes. Future research is planned 
that will explore the determination of efficient algorithms for use with multiple com- 
puters operating in parallel in order to evaluate all low weight stopping sets for 
commonly used LDPC codes several thousand bits long. 


13.5 Summary 


It has been shown that the indicative performance of an LDPC code may be deter- 
mined from exhaustive analysis of the low-weight spectral terms of the code's stop- 
ping sets which by definition includes the low-weight codewords. In a breakthrough, 
Rosnes and Ytrehus demonstrated the feasibility of exhaustive, low-weight stopping 
set analysis of codes whose parity-check matrix is sparse using a bounded tree search 
over the length of the code, with no distinction between information and parity bits. 
For an (п, k) code, the potential total search space is of size 2" but a good choice of 
bound dramatically reduces this search space to a practical size. Indeed, the choice of 
bound is critical to the success of the algorithm. It has been shown that an improved 
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algorithm can be obtained if the bounded tree search is applied to a set of k infor- 
mation bits since the potential total search space is initially reduced to size 2“. Since 
such a restriction will only find codewords and not all stopping sets, a class of bits is 
defined as unsolved parity bits, and these are also searched as appended bits in order 
to find all low-weight stopping sets. Weight spectrum results have been presented for 
commonly used WiMax LDPC codes in addition to some other well-known LDPC 
codes. 

An interesting area of future research has been identified whose aim is to improve 
the performance of the iterative decoder, for a given LDPC code, by determining 
low-weight codewords of the dual code and using these as additional parity-check 
equations. The tree search may be used to determine improvements to the code's 
stopping sets as a result. 
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Chapter 14 
Erasures апа Error-Correcting Codes 


14.1 Introduction 


It is well known that an (n, k, din) error-correcting code @, where n апа k denote 
the code length and information length, can correct din — 1 erasures [15, 16] where 
ап is the minimum Hamming distance of the code. However, itis not so well known 
that the average number of erasures correctable by most codes is significantly higher 
than this and almost equal to n — k. In this chapter, an expression is obtained for 
the probability density function (PDF) of the number of correctable erasures as a 
function of the weight enumerator function of the linear code. Analysis results are 
given of several common codes in comparison to maximum likelihood decoding 
performance for the binary erasure channel. Many codes including BCH codes, 
Goppa codes, double-circulant and self-dual codes have weight distributions that 
closely match the binomial distribution [13—15, 19]. It is shown for these codes that 
a lower bound of the number of correctable erasures is n —k — 2. The decoder error rate 
performance for these codes is also analysed. Results are given for rate 0.9 codes and 
it is shown for code lengths 5000 bits or longer that there is insignificant difference 
in performance between these codes and the theoretical optimum maximum distance 
separable (MDS) codes. The results for specific codes are given including BCH codes, 
extended quadratic residue codes, LDPC codes designed using the progressive edge 
growth (PEG) technique [12] and turbo codes [1]. 

The erasure correcting performance of codes and associated decoders has received 
renewed interest in the study of network coding as a means of providing efficient 
computer communication protocols [18]. Furthermore, the erasure performance of 
LDPC codes, in particular, has been used as a measure of predicting the code perfor- 
mance for the additive white Gaussian noise (AWGN) channel [6, 17]. One of the 
first analyses of the erasure correction performance of particular linear block codes 
is provided in a key-note paper by Dumer and Farrell [7] who derive the erasure 
correcting performance of long binary BCH codes and their dual codes. Dumer and 
Farrell show that these codes achieve capacity for the erasure channel. 
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14.2 Derivation of the PDF of Correctable Erasures 


14.2.1 Background and Definitions 


A set of s erasures is a list of erased bit positions defined as f; where 
O<i<s fi €0...n—1 


A codeword x = Х0,Х1...Х,-і satisfies the parity-check equations of the parity- 
check matrix H 
Hx'-0 


A codeword with s erasures is defined as 
X = (Хи, Xu, Xu, au dX Xf e Xf) 


where хи, аге the unerased coordinates of the codeword, and the set of s erased 
coordinates is defined as fs. There are a total of n — k parity check equations and 
provided the erased bit positions correspond to independent columns of the H matrix, 
each of the erased bits may be solved using a parity-check equation derived by the 
classic technique of Gaussian reduction [15-17]. For maximum distance separable 
(MDS) codes, [15], any set of s erasures are correctable by the code provided that 


sxn-—k (14.1) 


Unfortunately, the only binary MDS codes are trivial codes [15]. 


14.2.2 The Correspondence Between Uncorrectable Erasure 
Patterns and Low-Weight Codewords 


Provided the code is capable of correcting the set of s erasures, then a parity-check 
equation may be used to solve each erasure, viz: 


Ху = ho ,oXup +ho 1х, +F ho 2X sus „Ло n s 1Xu, 1 
Х = hi oXu, Th рхи, + hy 2Xm Sues Rinses 
Xp = һо,0Хш Tho Xy, + ho Хи» жз he s AX, 21 


Хр = hs—1,0Xm Tha, 1Хи + hs 2X, Tues Dis Ans, sa 


where Aj j is the coefficient of row i and column j of Н. 
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As the parity-check equations are Gaussian reduced, no erased bit is a function of 
any other erased bits. There will also be n — k — s remaining parity-check equations, 
which do not contain any of the erased bits’ coordinates ху: 


hs oXup F hs Xu, + hs 2Xy, АЕ Е Ns n s Xu, si =0 
hs4.1,0Xup + hs Xu, + hs4.1,2%uy ud E һу+1,п—5—1Хи—у-1 = 0 
hs42,0Xu + Рухи + Ns4.2,2Xuy ve hs2 ns Xu, 21 =0 
һл—к—1,0Җщу + Ййл—к—1,1Хи, + hn—k-1,2Xu нарын hy ks Xu, ua =0 


Further to this, the hypothetical case is considered where there is an additional erased 
bit ху. This bit coordinate is clearly one of the previously unerased bit coordinates, 
denoted as x,,. 

Xf. = Xu, 


Also, in this case it is considered that these s+ 1 erased coordinates do not correspond 
to s + 1 independent columns of ће Н matrix, but only to s + 1 dependent columns. 
This means that x,,, is not contained in any of the n — k — s remaining parity-check 
equations, and cannot be solved as the additional erased bit. 

For the first s erased bits whose coordinates do correspond to s independent 
columns of the H matrix, the set of codewords is considered in which all of the 
unerased coordinates are equal to zero except for x,,,. In this case the parity-check 
equations above are simplified to become: 


Xf — ho рхи, 

xf, = hy pXu, 

Xp = орхи, 
х = hs—1,pXu, 


As there are, by definition, at least n — s — 1 zero coordinates contained in each 
codeword, the maximum weight of any of the codewords above is s+ 1. Furthermore, 
any erased coordinate that is zero may be considered as an unsolved coordinate, since 
no non-zero coordinate is a function of this coordinate. This leads to the following 
theorem. 
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Theorem 1 77e non-zero coordinates of a codeword of weight w that is not the 
juxtaposition of two or more lower weight codewords, provide the coordinate posi- 
tions of w — 1 erasures that сап be solved and provide the coordinate positions of w 
erasures that cannot be solved. 


Proof Тһе coordinates of a codeword of weight w must satisfy the equations of the 
parity-check matrix. With the condition that the codeword is not constructed from 
the juxtaposition of two or more lower weight codewords, the codeword must have 
w — 1 coordinates that correspond to linearly independent columns of ће Н matrix 
and w coordinates that correspond to linearly dependent columns of the H matrix. 


Corollary 1 Given s coordinates corresponding to an erasure pattern containing s 
erasures, s < (n — k), of which w coordinates are equal to the non-zero coordinates 
of a single codeword of weight w, the maximum number of erasures that can be 
corrected is s — 1 and the minimum number that can be corrected is w — 1. 


Corollary 2 Given w — 1 coordinates that correspond to linearly independent 
columns of the Н matrix апа у coordinates that correspond to linearly dependent 
columns of the H matrix, a codeword can be derived that has a weight less than or 
equal to w. 


The weight enumeration function of a code [15] is usually described as a homo- 
geneous polynomial of degree n in x and y. 


n-l 


We (x, y) — DAS 


i=0 


The support of a codeword is defined [15] as the coordinates of the codeword that 
are non-zero. The probability of the successful erasure correction of s or more erasures 
is equal to the probability that no subset of the s erasure coordinates corresponds to 
the support of any codeword. 

The number of possible erasure patterns of s erasures of a code of length n is (7). 
For a single codeword of weight w, the number of erasure patterns with s coordinates 
that include the support of this codeword is (77%), Thus, the probability of a subset 
of the s coordinates coinciding with the support of a single codeword of weight w, 
prob(Xw € Қ) is given by: 


() 


prob(Xw € Ё) = 


апа d ' 
О ЕНЕ (n — му)! s! (n — s)! 


n! (s — w)! (n — s)! 


simplifying 


prob(x, € Ё) = 
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In such an event the s erasures are uncorrectable because, for these erasures, there 
are not s independent parity-check equations [15, 16]. However, s — 1 erasures are 
correctable provided the s — 1 erasures do not contain the support of a lower weight 
codeword. 

The probability that s erasures will contain the support of at least one codeword 
of any weight, is upper and lower bounded by 


5 


a (n — j)!s! (n — j)!s! 
1- ПІ Arni - 5i spe Arni - 5i (14.2) 


j=dmin J=dnin 


And given s + 1 erasures, the probability that exactly s erasures are correctable, 
Pr(s) is given by 


Pr(s) = Ру — Р, (14.3) 


Given up to n — k erasures the average number of erasures correctable by the 
code is 


n—k n—k 
Ne= C$ Pr) = S sai — Ps). (14.4) 
S=dmin S=dmin 
Carrying out the sum in reverse order and noting that Р, рр = 1, the equation 
simplifies to become 
n—k 
№. = (n—k)- У, Р, (14.5) 
S din 


An MDS code can correct n — К erasures and is clearly the maximum number of 
correctable erasures as there are only n — k independent parity-check equations. It 
is useful to denote an MDS shortfall 


n—k 
MDS shortfall = >> Р, (14.6) 
S=dmin 
and 
Ne = (n — k) — MDS ghortfalt (14.7) 
with 
n—k 5 Я 
(n — j)!s! 
І 1—Aj — < МЮ онға (14.8) 
ni(s — j)! 
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and 
VN (one Du 
MDS ghortfati < >, УА nG-p = T (149) 
5 duin j=dmin "ns — j 


The contribution made by the high multiplicity of low-weight codewords to the 
shortfall in MDS performance is indicated by the probability P; that the support of at 
least one codeword of weight j is contained in s erasures averaged over the number 
of uncorrectable erasures s, from s = d, to n — k, and is given by 


(п — js! 
h- D "e 2) 


14.3 Probability of Decoder Error 


For the erasure channel with erasure probability p, the probability of codeword 
decoder error, P; (р) for the code may be derived in terms of the weight spectrum 
of the code assuming ML decoding. It is assumed that a decoder error is declared 
if more than n — К erasures occur and that the decoder does not resort to guessing 
erasures. The probability of codeword decoder error is given by the familiar function 
of p. 


Pap) =  P,p'(1 — р)" (14.11) 


Splitting the sum into two parts 


n—k 


P4(p) = » Pura E py?) d > Ppa = р)“ (14.12) 


s=n—k+1 


The second term gives the decoder error rate performance for a hypothetical MDS 
code and the first term represents the degradation of the code compared to an MDS 
code. Using the upper bound of Eq. (14.2), 


— ps! ! 
Pup SrA = m pig c pe 


£e a Gs 


+ ee p – pe? (14.13) 


rap 
s=n— nua CEPIT 
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As well as determining the performance shortfall, compared to MDS codes, in terms 
of the number of correctable erasures it is also possible to determine the loss from 
capacity for the erasure channel. The capacity of the erasure channel with erasure 
probability p was originally determined by Elias [9] to be 1 — p. Capacity may be 
approached with zero codeword error for very long codes, even using non-MDS codes 
such as BCH codes [7]. However, short codes and even MDS codes, will produce 
a non-zero frame error rate (FER). For (n, k,n — k + 1) MDS codes, a codeword 
decoder error is deemed to occur whenever there are more than п — К erasures. (It 
is assumed here that the decoder does not resort to guessing erasures that cannot be 
solved). This probability, Pyps(p), is given by 


n—k ! 
n. 


Pups(p) = 1— асуға” Q7 P7 (14.14) 
5-0 


s)! s! 


The probability of codeword decoder error for the code may be derived from the 
weight enumerator of the code using Eq. (14.13). 


n—k 5 


(n — j)! s! n! : (n5) 
Poul) = ет RM 
+ а scrap») (14.15) 


This simplifies to become 


В РОА !( — ! 
Peode(P) = Y > A = 2 иш peg Pus) (4160 


! 
s=dpin ал е 


The first term in the above equation represents the loss from MDS code performance. 


14.4 Codes Whose Weight Enumerator Coefficients 
Are Approximately Binomial 


Itis well known that the distance distribution for many linear, binary codes including 
BCH codes, Goppa codes, self-dual codes [13—15, 19] approximates to a binomial 
distribution. Accordingly, 


n! 


А; R4 ———————— 14.17 
Ар: in 


For these codes, for which the approximation is true, the shortfall in performance 
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compared to ап MDS code, MDS shortfaii is obtained by substitution into Eq. (14.9) 


n—k s xi (n — pM s! 
! J)!s! 

MDS shortfall = = P353 HEE (14.18) 
2.2 (n - DUI nt G - j) 


which simplifies to 


-k 
2-1 
MDS shorgatt = 2 oe (14.19) 
5-І 
which leads to the simple result 
n—k—2 
MDS shortfa = 2 — - ЕЕ” 2 (14.20) 


It is apparent that for these codes the MDS shortfall is just 2 bits from correcting 
all n — К erasures. It is shown later using the actual weight enumerator functions 
for codes, where these are known, that this result is slightly pessimistic since in the 
above analysis there is a non-zero number of codewords with distance less than dyin. 
However, the error attributable to this is quite small. Simulation results for these codes 
show that the actual MDS shortfall is closer to 1.6 bits due to the assumption that 
there is never an erasure pattern which has the support of more than one codeword. 

For these codes whose weight enumerator coefficients are approximately bino- 
mial, the probability of the code being able to correct exactly s erasures, but no more, 
may also be simplified from (14.2) and (14.3). 


5+1 


Е n! (n —j)! (5+ 1)! 
Pr(s) -2 (n — jl 27-* n! (s 4- 1— j)! 


5 


Y Е (п ce (14.21) 
(а= j)! 2"-k n! (s — j)! 


which simplifies to become 
(14.22) 


for s < n — k and for s = n — k 


Y n! (n — j)! (n — k)! 


Pr(n—k) = 1 (n—j)!j!2"-* n! (n — k — j)! 


(14.23) 


j=l 


and 
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Table 14.1 PDF of number 


Correctable erasures Probability 
of correctable erasures for 1 
codes whose weight n—k 2n-k 
enumerator coefficients are n—k-1 0.5 — 3E 
binomial n—k-2 0.25 -z 
п-Ек-3 0.125 — 1, 
n—k-—4 0.0625 — +, 
n—-k—5 0.03125 — = 
n—k-—6 0.0150625 — = 
n—k-7 0.007503125 — z= 
n-k-s is 
Рп 0) = эу (14.24) 


For codes whose weight enumerator coefficients are approximately binomial, the pdf 
of correctable erasures is given in Table 14.1. 

The probability of codeword decoder error for these codes is given by substitution 
into (14.15), 


nk Ы n! 
Poode (P) = = PA — р)" + Рурѕ(р) (14.25) 
>; 2. 


As first shown by Dumer and Farrell [7] as n is taken to оо, these codes achieve the 
erasure channel capacity. As examples, the probability of codeword decoder error 
for hypothetical rate 0.9 codes, having binomial weight distributions, and lengths 
100 to 10,000 bits are shown plotted in Fig. 14.1 as a function of the channel erasure 
probability expressed in terms of relative erasure channel capacity = It can be 


seen that at a decoder error rate of 1078 the (1000, 900) code is operating at 95% 
of channel capacity, and the (10,000, 9,000) code is operating at 98% of channel 
capacity. A comparison with MDS codes is shown in Fig. 14.2. For codelengths 
from 500 to 50,000 bits, it can be seen that for codelengths of 5,000 bits and above, 
these rate 0.9 codes are optimum since their performance is indistinguishable from 
the performance of MDS codes with the same length and rate. 

A comparison of MDS codes to codes with binomial weight enumerator coeffi- 
cients is shown in Fig. 14.3 for 1 rate codes with code lengths from 128 to 1024. 
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Binomial 1000k900 
Binomial 5000k4500 
Binomial 10000k9000 
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Fig. 14.1 FER performance of codes with binomial weight enumerator coefficients 
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Fig. 14.2 Comparison of codes with binomial weight enumerator coefficients to MDS codes 
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Fig. 14.3 Comparison of half rate codes having binomial weight enumerator coefficients with MDS 


codes as a function of erasure probability 
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and Turbo Codes 


The first example is the extended BCH code (128, 99, 10) whose coefficients up to 
weight 30 of the weight enumerator polynomial [5] are tabulated in Table 14.2. 


Table 14.2 Low-weight 
spectral terms for the 


extended BCH (128, 99) code 0 
10 


12 
14 
16 
18 
20 


Weight 


Аа 
1 
796544 
90180160 
6463889536 
347764539928 
14127559573120 
445754705469248 
11149685265467776 
224811690627712384 
3704895377802191104 
50486556173121673600 
574502176730571255552 
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The PDF of the number of erased bits that are correctable up to the maximum 
of 29 erasures, derived from Eq. (14.1), is shown plotted in Fig. 14.4. Also shown 
plotted in Fig. 14.4 is the performance obtained numerically. It is straightforward, 
by computer simulation, to evaluate the erasure correcting performance of the code 
by generating a pattern of erasures randomly and solving these in turn using the 
parity-check equations. This procedure corresponds to maximum likelihood (ML) 
decoding [6, 17]. Moreover, the codeword responsible for any instances of non-MDS 
performance, (due to this erasure pattern) can be determined by back substitution into 
the solved parity-check equations. Except for short codes or very high rate codes, it 
is not possible to complete this procedure exhaustively, because there are too many 
combinations of erasure patterns. For example, there are 4.67 x 107% combinations 
of 29 erasures in this code of length 128 bits. In contrast, there are relatively few 
low-weight codewords responsible for ће non-MDS performance of the code. For 
example, each codeword of weight 10 is responsible for i5) — 4.13 x 10?! erasures 
patterns not being solvable. 

As the dmin of this code is 10, the code is guaranteed to correct any erasure pattern 
containing up to 9 erasures. It can be seen from Fig. 14.4 that the probability of not 
being able to correct any pattern of 10 erasures is less than 1075. The probability of 
correcting 29 erasures, the maximum number, is 0.29. The average number of erasures 
corrected is 27.44, almost three times the dmin, and the average shortfall from MDS 
performance is 1.56 erased bits. The prediction of performance by the lower bound is 
pessimistic due to double codeword counting in erasure patterns featuring more than 
25 bits or so. The effect of this is evident in Fig. 14.4. The lower bound average number 
of erasures corrected is 27.07, and the shortfall from MDS performance is 1.93 
erasures, an error of 0.37 erasures. The erasure performance evaluation by simulation 
is complementary to the analysis using the weight distribution of the code, in that 
the simulation, being a sampling procedure, is inaccurate for short, uncorrectable 
erasure patterns, because few codewords are responsible for the performance in this 
region. For short, uncorrectable erasure patterns, the lower bound analysis is tight 
in this region because it not possible for these erasure patterns to contain more than 
one codeword due to codewords differing by at least (мл. 

The distribution of the codeword weights responsible for non-MDS performance 
of this code is shown in Fig. 14.5. 

This is in contrast to the distribution of low-weight codewords shown in Fig. 14.6. 
Although there are a larger number of higher weight codewords, there is less chance 
of an erasure pattern containing a higher weight codeword. The maximum occurrence 
is for weight 14 codewords as shown in Fig. 14.5. 

The FER performance of the BCH (128, 107, 10) code is shown plotted in Fig. 14.7 
as a function of relative capacity defined by Cy Also, plotted in Fig. 14.7 is the 
FER performance of a hypothetical (128, 99, 30) MDS code. Equations (14.15) and 
(14.14), respectively, were used to derive Fig. 14.7. As may be seen from Fig. 14.7, 
there is a significant shortfall in capacity even for the optimum MDS code. This 
shortfall is attributable to the relatively short length of the code. At 107? FER, the 
BCH (128, 99, 10) code achieves approximately 80% of the erasure channel capacity. 
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Fig. 14.4 Erasure performance for the (128, 99, 10) Extended BCH Code 
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Fig. 14.5 Distribution of codeword weights responsible for non-MDS performance, of the (128, 
99, 10) BCH Code 
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Fig. 14.6 Distribution of low-weight codewords for the (128, 99, 10) BCH code 
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Fig. 14.7 FER performance for the (128, 99, 10) BCH code for the erasure channel 
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Table 14.3 Spectral terms up to weight 50 for the extended BCH (256, 207) code 


Weight Ад 
0 1 
14 159479040 
16 36023345712 
18 6713050656000 
20 996444422768640 
22 119599526889384960 
24 11813208348266177280 
26 973987499253055749120 
28 67857073021007558686720 
30 4036793565003066065373696 
32 206926366333597318696425720 
34 9212465086525810564304939520 
36 358715843060045310259622139904 
38 12292268362368552720093779880960 
40 372755158433879986474102933212928 
42 10052700091541303286178365979008000 
44 242189310556445744774611488568535040 
46 5233629101357641331155176578460897024 


48 101819140628807204943892435954902207120 
50 1789357109760781792970450788764603959040 


The maximum capacity achievable by апу (128, 99) binary code as represented by а 
(128, 99, 30) MDS code is approximately 82.5%. 

An example of a longer code is the (256, 207, 14) extended BCH code. The 
coefficients up to weight 50 of the weight enumerator polynomial [10] are tabulated 
in Table 14.3. The evaluated erasure correcting performance of this code is shown in 
Fig. 14.8, and the code is able to correct up to 49 erasures. It can be seen from Fig. 14.8 
that there is а close match between the lower bound analysis and the simulation results 
for the number of erasures between 34 and 46. Beyond 46 erasures, the lower bound 
becomes increasingly pessimistic due to double counting of codewords. Below 34 
erasures the simulation results are erratic due to insufficient samples. It can be seen 
from Fig. 14.8 that the probability of correcting only 14 erasures is less than 10713 
(actually 5.4 x 10714) even though the dmin of the code is 14. If a significant level of 
erasure correcting failures is defined as 1079, then from Fig. 14.8, this code is capable 
of correcting up to 30 erasures even though the guaranteed number of correctable 
erasures is only 13. The average number of erasures correctable by the code is 47.4, an 
average shortfall of 1.6 erased bits. The distribution of codeword weights responsible 
for the non-MDS performance of this code is shown in Fig. 14.9. 

The FER performance of the BCH (256, 207, 14) code is shown plotted in 


Fig. 14.10 as a function of relative capacity defined by = Also plotted in 
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Fig. 14.8 PDF of erasure corrections for the (256, 207, 14) Extended BCH Code 
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Fig. 14.9 Distribution of codeword weights responsible for non-MDS performance, for the 
extended (256, 207, 14) BCH Code 
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Fig. 14.10 FER performance for the (256, 207, 14) BCH Code for the erasure channel 


Fig. 14.10 is the FER performance of a hypothetical (256, 207, 50) MDS code. 
Equations (14.15) and (14.14), respectively, were used to derive Fig. 14.10. As may 
be seen from Fig. 14.10, there is less of a shortfall in capacity compared to the BCH 
(128, 107, 10) code. At 107° FER, the BCH (256, 207, 14) code achieves approxi- 
mately 85.596 of the erasure channel capacity. The maximum capacity achievable by 
any (256, 207) binary code as represented by the (256, 207, 50) hypothetical MDS 
code is approximately 87%. 

The next code to be investigated is the (512, 457, 14) extended BCH code which 
was chosen because it is comparable to the (256, 207, 14) code in being able to 
correct a similar maximum number of erasures (55 cf. 49) and has the same dmin of 
14. Unfortunately, the weight enumerator polynomial has yet to be determined, and 
only erasure simulation results may be obtained. Figure 14.11 shows the performance 
of this code. The average number of erasures corrected is 53.4, an average shortfall 
of 1.6 erased bits. The average shortfall is identical to the (256, 207, 14) extended 
BCH code. Also, the probability of achieving MDS code performance, i.e. being able 
to correct all п- k erasures is also the same and equal to 0.29. The distribution of 
codeword weights responsible for non-MDS performance of the (512, 457, 14) code 
is very similar to that for the (256, 207, 14) code, as shown in Fig. 14.12. 

An example of an extended cyclic quadratic residue code is the (168, 84, 24) 
code whose coefficients of the weight enumerator polynomial have been recently 
determined [20] and are tabulated up to weight 72 in Table 14.4. This code is a 
self-dual, doubly even code, but not extremal because its dmin is not 32 but 24 [3]. 
The FER performance of the (168, 84, 24) code is shown plotted in Fig. 14.13 as 
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Fig. 14.11 PDF of erasure corrections for the (512, 457, 14) Extended BCH Code 
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Fig. 14.12 Distribution of codeword weights responsible for non-MDS performance, for the 
extended (512, 457, 14) BCH Code 
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Table 14.4 ectral terms : 

ее 5 for the Weight да 

extended Quadratic Residue 0 1 

(168, 84) code 24 776216 
28 18130188 
32 5550332508 
36 1251282702264 
40 166071600559137 
44 13047136918828740 
48 629048543890724216 
52 19087130695796615088 
56 372099690249351071112 
60 4739291519495550245228 
64 39973673337590380474086 
68 225696677727188690570184 
72 860241108921860741947676 


Maka 
ean (1 ) s 


FER 


10? L i П i i 
1.2 14 1 0.9 0.8 0.7 0.6 


Relative ersure channel capacity 


Fig. 14.13 FER performance for the (168, 84, 24) eQR Code for the erasure channel 


a function of relative capacity defined by C». Also plotted in Fig. 14.13 is the 
FER performance of a hypothetical (168, 84, 85) MDS code. Equations (14.15) and 
(14.14), respectively, were used to derive Fig. 14.13. The performance of the (168, 
84, 24) code is close to that of the hypothetical MDS code but both codes are around 
30% from capacity at 10-9 FER. 
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The erasure correcting performance of non-algebraic designed codes is quite dif- 
ferent from algebraic designed codes as may be seen from the performance results 
for a (240, 120, 16) turbo code shown in Fig. 14.14. The turbo code features mem- 
огу 4 constituent recursive encoders and a code matched, modified S interleaver, іп 
order to maximise the dmin of the code. The average number of erasures correctable 
by the code is 116.5 and the average shortfall is 3.5 erased bits. The distribution of 
codeword weights responsible for non-MDS performance of the (240, 120, 16) code 
is very different from the algebraic codes and features a flat distribution as shown in 
Fig. 14.15. 

Similarly, the erasure correcting performance of a (200, 100, 11) LDPC code 
designed using the Progressive Edge Growth (PEG) algorithm [12] is again quite 
different from the algebraic codes as shown in Fig. 14.16. As is typical of randomly 
generated LDPC codes, the dmin of the code is quite small at 11, even though the 
code has been optimised. For this code, the average number of correctable erasures 
is 93.19 and the average shortfall is 6.81 erased bits. This is markedly worse than 
the turbo code performance. It is the preponderance of low-weight codewords that 
is responsible for the inferior performance of this code compared to the other codes 
as shown by the codeword weight distribution in Fig. 14.17. 

The relative weakness of the LDPC code and turbo code becomes clear when 
compared to a good algebraic code with similar parameters. There is a (200, 100, 32) 
extended quadratic residue code. The p.d.f. of the number of erasures corrected by 
this code is shown in Fig. 14.18. The difference between having a dmin of 32 compared 
to 16 for the turbo code and 10 for the LDPC code is dramatic. The average number 
of correctable erasures is 98.4 and the average shortfall is 1.6 erased bits. The weight 
enumerator polynomial of this self-dual code, is currently unknown as evaluation of 
the 2!9? codewords is currently beyond the reach of today's computers. However, the 
distribution of codeword weights responsible for non-MDS performance of the (200, 
100, 32) code which is shown in Fig. 14.19 indicates the doubly even codewords of 
this code and the дм of 32. 


14.5.1 Turbo Codes with Dithered Relative Prime (DRP) 
Interleavers 


DRP interleavers were introduced in [4]. They have been shown to produce some 
of the largest minimum distances for turbo codes. However, the iterative decoding 
algorithm does not exploit this performance to its full on AWGN channels where the 
performance of these interleavers is similar to that of randomly designed interleavers 
having lower minimum distance. This is due to convergence problems in the error 
floor region. A DRP interleaver is a concatenation of 3 interleavers, the two dithers 
A, B and a relative prime interleaver 7r: 


IÒ) = B(x(AG))) (14.26) 
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Fig. 14.14 PDF of erasure corrections for the (240, 120, 16) turbo code 
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Fig. 14.15 Distribution of codeword weights responsible for non-MDS performance, for the (240, 
120, 16) turbo code 
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Fig. 14.16 PDF of erasure corrections for the (200, 100, 10) PEG LDPC code 


Fig.14.17 Distribution of codeword weights responsible for non-MDS performance, for the (200, 


Number 


108 — 


105 H 


100 


| | 


.... Weight distribution (200,100,10) 


" 


0 10 


20 30 40 50 60 70 


Distribution of low weight codewords for the (200,100,10) PEG LDPC code 


100, 10) PEG LDPC code 


80 


14.5 MDS Shortfall for Examples of Algebraic, LDPC and Turbo Codes 389 


(200,100,32) едг simulation С 


Probability 


1 0710 [ 1 i i 
0 20 40 60 80 100 


PDF of number of corrected erased bits 


Fig. 14.18 PDF of erasure corrections for the (200, 100, 32) Extended QR Code 
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Fig. 14.19 Distribution of codeword weights responsible for non-MDS performance, for the (200, 
100, 32) Extended QR Code 
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Table 14.5 Minimum | k 40 200 400 1000 
distance of turbo codes using 

DRP interleavers as compared DRP 19 33 38 45 
to S-random interleavers S-RAN 13 17 22 26 


The dithers are short permutations, generally of length m = 4, 8, 16 depending 
on the length of the overall interleaver. We have 


A(i) = m Li/m| + ат (14.27) 
B(i) = m|i/m| + bis (14.28) 
(i) = (pit q)%m, (14.29) 


where a, b, are permutations of length m and p must be relatively prime to k. If a, b 
and p are properly chosen, the minimum distance of turbo codes can be drastically 
improved as compared to that of a turbo code using a typical -random interleaver. 
A comparison is shown in Table 14.5 for memory 3 component codes. 

As an example two turbo codes are considered, one employing a DRP interleavers, 
having parameters (120, 40, 19) and another employing a typical -random inter- 
leaver and having parameters (120, 40, 13). 


14.5.2 Effects of Weight Spectral Components 


The weight spectrum of each ofthe two turbo codes has been determined exhaustively 
from the G matrix of each code by codeword enumeration using the revolving door 
algorithm. The weight spectrum of both of the two turbo codes is shown in Table 14.6. 
It should be noted that as the codes include the all ones codeword, А, ; = Aj, only 
weights up to Асо are shown in Table 14.6. 

Using the weight spectrum of each code the upper and lower bound cumulative 
distributions and corresponding density functions have been derived using Eqs. (14.2) 
and (14.3), respectively, and are compared in Fig. 14.20. It can be observed that the 
DRP interleaver produces a code with a significantly smaller probability of failing 
to correct a given number of erasures. 

The MDS shortfall for the two codes is: 


MDS shortfan (120, 40, 19) = 2.95 bits (14.30) 


MDSshortfan (120, 40, 13) = 3.29 bits (14.31) 


The distribution of the codeword weights responsible for the MDS shortfalls is 
shown in Fig. 14.21. For interest, also shown in Fig. 14.21 is the distribution for 


14.5 MDS Shortfall for Examples of Algebraic, LDPC and Turbo Codes 391 


Table 14.6 Weight spectrum of the (120, 40, 19) and (120, 40, 13) turbo codes. Multiplicity for 
weights larger than 60 satisfy Аво; = A6o+i 


Weight Multiplicity 
(120, 40, 19) (120, 40, 13) 
0 1 1 
13 0 3 
14 0 6 
15 0 3 
16 0 15 
17 0 21 
18 0 17 
19 10 52 
20 100 82 
21 130 136 
22 300 270 
23 450 462 
24 880 875 
25 1860 2100 
26 3200 3684 
27 7510 7204 
28 14715 15739 
29 29080 30930 
30 63469 64602 
31 137130 137976 
32 279815 279700 
33 611030 608029 
34 1313930 1309472 
35 2672760 2671331 
36 5747915 5745253 
37 12058930 12045467 
38 24137345 24112022 
39 49505760 49486066 
40 97403290 97408987 
41 183989250 184005387 
42 347799180 347810249 
43 626446060 626489895 
44 1086030660 1086006724 
45 1855409520 1855608450 
46 3021193870 3021448047 
47 4744599030 4744412946 
48 7286393500 7286669468 
49 10691309800 10690683197 
50 15157473609 15156479947 


(continued) 


392 14 Егаѕшеѕ and Error-Correcting Codes 


Table 14.6 (continued) 


Weight Multiplicity 
(120, 40, 19) (120, 40, 13) 
51 20938289040 20939153481 
52 27702927865 27702635729 
53 35480878330 35481273341 
54 44209386960 44210370096 
55 52854740864 52853468145 
56 61256875090 61257409658 
57 69008678970 69008947092 
58 74677319465 74677092916 
59 78428541430 78428875230 
60 80007083570 80006086770 
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Fig. 14.20 Probability of Maximum Likelihood decoder failure 


(120, 40, 28) best known linear code. This code, which is chosen to have the same 
block length and code rate as the turbo code, is derived by shortening a (130, 50, 28) 
code obtained by adding two parity checks to the (128, 50, 28) extended BCH. This 
linear code has an MDS shortfall of 1.62 bits and its weight spectrum consists of 
doubly even codewords as shown in Table 14.7. For the turbo codes the contribution 
made by the lower weight codewords is apparent in Fig. 14.21, and this is confirmed 
by the plot of the cumulative contribution made by the lower weight codewords 
shown in Fig. 14.22. 
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Table 14.7 Weight spectrum 


of the linear (120, 40, 28) Weight j эн 
code derived from the 0 1 
extended BCH (128, 50, 28) 28 5936 
code 32 448563 
36 17974376 
40 379035818 
44 4415788318 
48 29117944212 
52 110647710572 
56 245341756158 
60 319670621834 
64 245340760447 
68 110648904336 
72 29117236550 
76 4415980114 
80 379051988 
84 17949020 
88 453586 
92 5910 
96 37 
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Fig. 14.21 Distribution of codeword weights responsible for non-MDS performance 
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Fig. 14.22 Cumulative code weight contribution to MDS shortfall 
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Fig. 14.23 Probability of ML decoder error for the erasure channel 
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For the erasure channel, the performance of the two turbo codes and the 
(120, 40, 28) code is given by (14.15) and is shown in Fig. 14.23 assuming ML 
decoding. Also shown in Fig. 14.23 is the performance of a (hypothetical) binary 
(120, 40, 81) MDS which is given by the second term of (14.15). The code derived 
from the shortened, extended BCH code, (120, 40, 28), has the best performance 
and compares well to the lower bound provided by the MDS hypothetical code. The 
DRP interleaver turbo code also has good performance, but the .“-random interleaver 
turbo code shows an error floor due to the dnin of 13. 


14.6 Determination of the dmin of Any Linear Code 


Itis well known that the determination of weights of any linear code is a Nondeter- 
ministic Polynomial time (NP) hard problem [8] and except for short codes, the best 
methods for determining the minimum Hamming distance, dmin codeword of a linear 
code, to date, are probabilistically based [2]. Most methods are based on the gener- 
ator matrix, the G matrix of the code and tend to be biased towards searching using 
constrained information weight codewords. Such methods become less effective for 
long codes or codes with code rates around 1 because the weights of the evaluated 
codewords tend to be binomially distributed with average weight 5 [15]. 

Corollary 2 from Sect. 14.2 above, provides the basis of a probabilistic method to 
find low-weight codewords in a significantly smaller search space than the G matrix 
methods. Given an uncorrectable erasure pattern of n — k erasures, from Corollary 2, 
the codeword weight is less than or equal to n — К. The search method suggested 
by this, becomes one of randomly generating erasure patterns of n — k 4- 1 erasures, 
which of course are uncorrectable by any (n,k) code, and determining the codeword 
and its weight from (14.2). This time, the weights of the evaluated codewords will 
tend to be binomially distributed with average weight "1. With this trend, for 
N44, the number of codewords determined with weight d, Ма is given by 


(n — k 4-1)! 


Ма = М.наһ 
amas a(n — ка + 112-41 


(14.32) 


As an example of this approach, the self-dual, bordered, double-circulant code (168, 
84) based on the prime number 83, is described in [11] as having an unconfirmed 
dmin Of 28. From (14.32) when using 18,000 trials, 10 codewords of weight 28 will 
be found on average. However, as the code is doubly even and only has codewords 
weights which are a multiple of 4, using 18,000 trials, 40 codewords are expected. 
In a set of trials using this method for the (168, 84) code, 61 codewords of weight 28 
were found with 18,000 trials. Furthermore, 87 codewords of weight 24 were also 
found indicating that the din of this code is 24 and not 28 as was originally expected 
in [11]. 

The search method can be improved by biasing towards the evaluation of erasure 
patterns that have small numbers of erasures that cannot be solved. Recalling the 
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analysis in Sect. 14.2, as the parity-check equations are Gaussian reduced, no erased 
bit is a function of any other erased bits. There will be n — k — s remaining parity- 
check equations, which do not contain the erased bit coordinates xp. These remaining 
equations may be searched to see if there is an unerased bit coordinate, that is not 
present in any of the equations. If there is one such coordinate, then this coordinate in 
conjunction with the erased coordinates solved so far forms an uncorrectable erasure 
pattern involving only s erasures instead of n — k -- 1 erasures. With this procedure, 
biased towards small numbers of unsolvable erasures, it was found that, for the above 
code, 21 distinct codewords of weight 24 and 17 distinct codewords of weight 28 
were determined in 1000 trials and the search took approximately 2s on a typical 
2.8GHz, Personal Computer (PC). 

In another example, the (216, 108) self dual, bordered double-circulant code is 
given in [11] with an unconfirmed 4м» of 36. With 1000 trials which took 7s on 
the PC, 11 distinct codewords were found with weight 24 and a longer evaluation 
confirmed that the d,nin of this code is indeed 24. 


14.7 Summary 


Analysis of the erasure correcting performance of linear, binary codes has provided 
the surprising result that many codes can correct, on average, almost n —k erasures and 
have a performance close to the optimum performance as represented by (hypothet- 
ical), binary MDS codes. It was shown that for codes having a weight distribution 
approximating to a binomial distribution, and this includes many common codes, 
such as BCH codes, Goppa codes and self-dual codes, that these codes can correct at 
least n — k — 2 erasures on average, and closely match the FER performance of MDS 
codes as code lengths increase. The asymptotic performance achieves capacity for 
the erasure channel. It was also shown that codes designed for iterative decoders, the 
turbo and LDPC codes, are relatively weak codes for the erasure channel and com- 
pare poorly with algebraically designed codes. Turbo codes, designed for optimised 
dmin, Were found to outperform LDPC codes. 

For turbo codes using DRP interleavers for the erasure channel using ML decod- 
ing, the result is that these relatively short turbo codes are (on average), only about 3 
erasures away from optimal MDS performance. The decoder error rate performance 
of the two turbo codes when using ML decoding on the erasure channel was com- 
pared to (120, 40, 28) best known linear code and a hypothetical binary MDS code. 
The БЕР interleaver demonstrated a clear advantage over the -random interleaver 
and was not too far way from MDS performance. Analysis of the performance of 
longer turbo codes is rather problematic. 

Determination of the erasure correcting performance of a code provides a means 
of determining the dmin of a code and an efficient search method was described. 
Using the method, the йм» results for two self-dual codes, whose dmin values were 
previously unknown were determined, and these codes were found to be (168, 84, 
24) and (216, 108, 24) codes. 
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Chapter 15 
The Modified Dorsch Decoder 


15.1 Introduction 


In a relatively unknown paper published in 1974, Dorsch [4] described a decoder for 
linear binary block (n, k) codes using soft decisions quantised to J levels. The decoder 
is applicable to any linear block code and does not rely upon any particular features of 
the code, such as being a concatenated code or having a sparse parity-check matrix. In 
the Dorsch decoder, hard decisions are derived from the soft decisions using standard 
bit by bit detection, choosing the binary state closest to the received coordinate. The 
hard decisions are then ranked in terms of their likelihoods and candidate codewords 
are derived from a set of k, independent, most likely bits. This is done by producing 
a new parity-check matrix Hy obtained by reordering the columns of the original 
H matrix according to the likelihood of each coordinate, and reducing the resulting 
matrix to echelon canonical form by elementary row operations. After evaluation of 
several candidate codewords, the codeword with the minimum soft decision metric 
is output from the decoder. A decoder using a similar principle, but without soft 
decision quantisation, has been described by Fossorier [5, 6]. Other approaches, 
after ranking the reliability of the received bits, adopt various search strategies for 
finding likely codewords [11] or utilise a hard decision decoder in conjunction with 
a search for errors in the least likely bit positions [2, 15]. 

The power of the Dorsch decoder arises from the relatively unknown property 
that most codes, on average, can correct almost n — К erasures [17], which is con- 
siderably more than the guaranteed number of correctable erasures of d, — 1, or 
the guaranteed number of correctable hard decision errors of dl , Where d,nin is the 
minimum Hamming distance of the code. In its operation, the Dorsch decoder needs 
to correct any combination of n — k erasures which is impossible unless the code 
is an MDS code [12]. Dorsch did not discuss this problem, or potential solutions, 
in his original paper [4], although at least one solution is implied by the results he 
presented. 
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In this chapter, a solution to the erasure correcting problem of being able to solve 
n — k erasures for a non-MDS code is described. It is based on using alternative 
columns of the parity-check matrix without the need for column permutations. It is 
also shown that it is not necessary to keep recalculating each candidate codeword 
and its associated soft decision metric in order to find the most likely codeword. 
Instead, an incremental correlation approach is adopted which features low informa- 
tion weight codewords and a correlation function involving only a small number of 
coordinates of the received vector [17]. It is proven that maximum likelihood decod- 
ing is realised provided all codewords are evaluated up to a bounded information 
weight. This means that maximum likelihood decoding may be achieved for a high 
percentage of received vectors. The decoder lends itself to a low complexity, parallel 
implementation involving a concatenation of hard and soft decision decoding. It pro- 
duces near maximum likelihood decoding for codes that can be as long as 1000 bits, 
provided the code rate is high enough. When implementing the decoder, it is shown 
that complexity may be traded-off against performance in a flexible manner. Decod- 
ing results, achieved by the decoder, are presented for some of the most powerful 
binary codes known and compared to Shannon's sphere packing bound [14]. 

The extension to non-binary codes is straightforward and this is described in 
Sect. 15.5. 


15.2 TheIncremental Correlation Dorsch Decoder 


Codewords with binary coordinates having state 0 or 1, are denoted as: 
х= (хо. х], X2, кж» Ха-1) 


For transmission, bipolar transmission is used with coordinates having binary state 
0 mapped to +1 and having state 1 mapped to —1. Transmitted codewords are 
denoted as 

C= (Cp; €t; C2, «y Cn 1) 


The received vector г consists of n coordinates (ro, r1, r2, ..., r4 1) equal to the 
transmitted codeword plus Additive White Gaussian Noise with variance o?. The 


received vector processed by the decoder is assumed to have been matched filtered 
and free from distortion so that 4 = 22, where Ер is the energy per information bit 


and N, is the single sided noise power spectral density. Accordingly, 


2 № 


Oo = 
2E, 


The basic principle that is used is that the k most reliable bits of the received vector 
are initially taken as correct and the n — k least reliable bits are treated as erasures. 
The parity-check equations of the code, as represented by H, are used to solve for 
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these erased bits and a codeword X is obtained. This codeword is either equal to the 
transmitted codeword or needs only small changes to produce a codeword equal to the 
transmitted codeword. One difficulty is that, depending on the code, the n — k least 
reliable bits usually cannot all be solved as erasures. This depends on the positions of 
the erased coordinates and the power of the code. Only Maximum Distance Separable 
(MDS) codes [12] are capable of solving n — К erasures regardless of the positions of 
the erasures in the received codeword. Unfortunately, there are no binary MDS codes 
apart from trivial examples. However, a set of п — К erasures can always be solved 
from n — k + s least reliable bit positions, and, depending on the code, s is usually a 
small integer. In order to obtain best performance it is important that the very least 
reliable bit positions are solved first, since the corollary that the п — k least reliable 
bits usually cannot all be solved as erasures is that the k most reliable bits, used to 
derive codeword X, must include a small number of least reliable bits. However, for 
most received vectors, the difference in reliability between ranked bit k and ranked 
bitk + sis usually small. For any received coordinate, the a priori log likelihood ratio 
of the bit being correct is proportional to |r;|. The received vector г with coordinates 
ranked in order of most likely to be correct is defined as (ru, ru, ги, +++ Tu, i). 
where |ru] > (fui) > Iri] > +++ dra, ||. 

The decoder is most straightforward for a binary MDS code. The codeword 
coordinates (Хи, Хи, Xuz» <- -s Xu, ,) are formed directly from the received vector 
г using the bitwise decision rule x,, = 1 if rj, < О else x,, = 0. The n — k coordi- 
nates (Xy, , Хик, Хш», +++» Хи, т) are considered to be erased and derived from the k 
most reliable codeword coordinates (Xj), Х.Х... Xy, ,) using the parity-check 
equations. 

For a non-MDS code, the п- k coordinates cannot always be solved from the 
parity-check equations because the parity-check matrix is not a Cauchy or Vander- 
monde matrix [12]. To get around this problem a slightly different order is defined 
Оле» Хау» Xna» ++ Xn a)- 

The label of the last coordinate 7-1 is set equal to и, and x,, , solved first by 
flagging the first parity-check equation that contains x,, |, and then subtracting this 
equation from all other parity-check equations containing x,,_,. Consequently, x, | 
is now only contained in one equation, the first flagged equation. 

The label of the next coordinate 5j,» is set equal to 14,» and an attempt is made to 
solve x, , by finding an unflagged parity-check equation containing x; ,. In the event 
that there is not an unflagged equation containing x; ,, Nn—2 is set equal to Lu, 5 the 
label of the next most reliable bit, x,,, , and the procedure repeated until an unflagged 
equation contains ху ,. As before, this equation is flagged that it will be used to solve 
for x,,_, and is subtracted from all other unflagged equations containing x;,, ,. The pro- 
cedure continues until all ofthe n — k codeword coordinates x,, ,, xj, >» Xmas + +> Xm 
have been solved and all — k equations have been flagged. In effect, the least reliable 
coordinates are skipped if they cannot be solved. The remaining К ranked received 


coordinates аге set equal to (rj, rj, Fm» -+ -> Р) in most reliable order, where 
nol > Ial > al > [2 and (х, xy s Әр»... Ху 1) determined using the 
bit decision rule x,, = 1 if г, < 0 else x,, = 0. The flagged parity-check equations 


are in upper triangular form and have to be solved in reverse order starting with the 
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last flagged equation. This equation gives the solution to x,, which is back substituted 
into the other equations and x,,,, is solved next, back substituted, and so on, with 
coordinate x,, | solved last. 

This codeword is denoted as X and the mapped version of the codeword is 
denoted as €. 

Asis well-known [13], the codeword most likely to be transmitted is the codeword, 
denoted as X, which has the smallest squared Euclidean distance, D(X), between the 
mapped codeword, €, and the received vector. 


п—1 


р = Уу) 


j=0 


D(x) < D(x) for all other codewords x. 
Equivalently x is the codeword, after mapping, which has the highest cross 
correlation 


n-l 


Ү => ух (15.1) 


j=0 


Y(x) > Y(x) for all other codewords x. 
The decoder may be simplified if the cross correlation function is used to compare 
candidate codewords. The cross correlation is firstly determined for the codeword x 


п-1 


Ү@ = > nx (15.2) 


j=0 


It is interesting to make some observations about Y (X). Since the summation can be 
carried out in any order 


п—1 
YR =J n XG, (15.3) 
1-0 
апа 
k-1 п—1 
Ү@ = > ry X ên p» Aog (15.4) 
j=0 j-k 
Considering the first term 
k-1 k-1 


Sy x ên ХЫ (15.5) 


j-0 j=0 


15.2 Тһе Incremental Correlation Dorsch Decoder 403 


This is because the sign of ¢,, equals the sign of ¢,, for j < k. Thus, this term is 
independent of the code and Eq. (15.4) becomes 


k—1 п—1 
Y) => pr] > у x ên (15.6) 
j=0 jak 


Almost all of the k largest received coordinates (all of the k largest terms for an MDS 
code) are contained in the first term of Eq. (15.6) and this ensures that the codeword 
X, after mapping, has a high correlation with r. 

A binary, (hard decision), received vector b may be derived from the received 
vector г using the bitwise decision rule b; = 1 if r; < 0, else b; = 0 for j = 0 to 
n — 1. It should be noted that in general the binary vector b is not a codeword. 

It is useful to define a binary vector Z as 


3-һө% (15.7) 


The maximum attainable correlation Ymax is given by 


Ymax = i (15.8) 


This correlation value occurs when there are no bit errors in transmission and provides 
an upper bound to the maximum achievable correlation for X. The correlation Y (X) 
may be expressed in terms of Ying, and Х for 


п-1 
Y) = Ymax кезі 2% х ШІ (15.9) 
j-0 
equivalently, 
Y(&) = Ymar — YA(&), (15.10) 


where Y4 (Ñ) is the shortfall from the maximum achievable correlation for the code- 
word х and is evidently 


п-1 


Үл@ =2 > 2y x Iryl (15.11) 
j=0 


Some observations may be made about the binary vector 2. The coordinates 2, for 


j = 0 to (k — 1) are always equal to zero. The maximum possible weight of z is thus 
n — k and the average weight is ak at low га values. At high values, the average 


weight of Z is small because there is a high chance that X is equal to the transmitted 
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codeword. It may be seen from Eq. (15.11) that, in general, the lower the weight of 
2 the smaller will be YA(X) and the larger will be the correlation value Y (X). 

Since there is no guarantee that the codeword X is the transmitted codeword, the 
decoder has to evaluate additional codewords since one or more of these may produce 
a correlation higher than &. There are 2^ — 1 other codewords which may be derived 
by considering all other 2“ — 1 sign combinations of с, for j = О to k — 1. For any 
of these codewords denoted as c; the first term of the correlation given in Eq. (15.6) 
is bound to be smaller since 


k-1 


k-1 
Sa PA (15.12) 
j=0 


j-0 


This is because there has to be, by definition, at least one sign change of c;,,, compared 
to ĉn; for j = 0 to k — 1. In order for Y (x;) to be larger than Y(X) the second term 
п-1 


of the correlation У j- Tn; X Сілу Which uses the bits from the solved parity-check 


equations must be larger than Ж. т X €,, plus the negative contribution from the 
first term. 

However, the first term has higher received magnitudes than the second term 
because the received coordinates are ordered. It follows that codewords likely to have 
a higher correlation than X will have small number of differences in the coordinates 
ху, for j = 0 to k — 1. As the code is linear these differences will correspond to 
a codeword and codewords may be generated that have low weight in coordinates 
Xy, for j = 0 to К — 1. These codewords are represented as X; and referred to as 
low information weight codewords since coordinates ху, for j = 0 to k — 1 form an 
information set. Thus, codewords х; are given by 


х= Ф (15.13) 


and X; аге codewords chosen to have increasing weight in coordinates xy, for j = 0 to 
k — 1 as i is incremented. This means that for increasing i it will become less likely 
that a codeword will be found that has higher correlation than the correlation of a 
codeword already found. 

The difference in the correlation value Ул (xi) as a function of X; may be derived. 
Firstly, the binary vector 24 is given by 


z-boxaox (15.14) 
which may be simplified to 


z -io& (15.15) 
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The cross correlation Y (xi) is given by 


п—1 


Y (Xi) = Ymax — 277, n X ЕА (15.16) 
j=0 


equivalently 
Y (Xi) = Ymar — Yai) (15.17) 


The shortfall from maximum correlation, Үл (xi), is evidently 


n-l 


Үл) = 27 zs X Ins (15.18) 
j=0 


Substituting for 2; gives YA(xi) as a function of X. 


п-1 


уда)-2У6ө%) x Iryl (15.19) 
j=0 


It is apparent that instead of the decoder determining Y (x;) for each codeword, хі, 
it is sufficient for the decoder to determine Ул (xi) for each codeword x; and compare 
the value with the smallest value obtained so far, denoted as Үл (хым), starting with 
Y, A (X): 


YA Xin) = min(YA (x) (15.20) 


Thus it is more efficient for the decoder to compute the correlation (partial sum) of 
the X; instead of deriving (€ Ө X) by solving Hy and computing the squared Euclidean 
distance. Since codewords x; produce low weight in 24, the number of non-zero terms 
that need to be evaluated in Eq. (15.18) is typically ak rather than the 5 terms of 
Eq. (15.1) which makes for an efficient, fast decoder. Before Eq. (15.19) is evaluated, 
the Hamming weight of z; may be compared to a threshold and the correlation stage 
bypassed if the Hamming weight of zi is high. There is an associated performance 
loss and results are presented in Sect. 15.4. 

The maximum information weight Win max necessary to achieve maximum like- 
lihood decoding may be upper bounded from Үд(Х) and |r,,| initially, updated by 
Y,(Xmin) as decoding progresses, since 


Winf 


Үл() > У (15.21) 


m=0 
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This is reasonably tight since there is a possibility of at least one codeword with 
information weight Wing max, for which all of the coordinates of the binary vector 
z corresponding to the parity bits of X; are zero. Correspondingly, Wing max is the 
smallest integer such that 


Winf max 


У Imaal > УА@ (15.22) 


т-0 


Тһе codewords x; may be most efficiently derived from (һе G matrix corresponding to 
the solved H matrix because the maximum information weight given by Eq. (15.22) 
turns out to be small. Each row, i, of the solved G matrix is derived by setting Xy = 0 
for j = 0 to k — 1, ji, and using the solved parity-check equations to determine х, 
for j = k ton — 1. The maximum number of rows of the С matrix that need to be 
combined to produce Xi is Wing тах: 


15.3 Number of Codewords that Need to Be Evaluated 
to Achieve Maximum Likelihood Decoding 


For each received vector the decoder needs to evaluate the correlation shortfall for 
the codewords x; for information weights up to the maximum information weight of 
Winf max iN order to achieve maximum likelihood decoding. The number of codewords 
that need to be evaluated is a function of the received vector. Not all of the codewords 
having information weight less than or equal to Wing max need be evaluated because 
lower bounds may be derived for Y 4 (x;) in terms of the coordinates of the information 
bits, their total weight and the magnitudes of selected coordinates of the received 
vector. For an information weight of wing, Ул (хі) is lower bounded by 


Wing —1 


Ул() > - У dl 0О<ўу<К—т (15.23) 
m=0 
and 
Wing —1 
та> XA) — У rail OSf<k—m (15.24) 
m=0 


where jjj, (Wing) is defined as the lower limit for j to satisfy Eq. (15.24). The minimum 
number of codewords that need to be evaluated as a function of the received vector 
N(r) is given by the total number of combinations 
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Winf 2 _ 
мт = У, ( шы J (15.25) 


m=0 "m 
For many short codes the minimum number of codewords that need to be evaluated 
18 surprisingly small in comparison to the total number of codewords. 


15.4 Results for Some Powerful Binary Codes 


The decoder can be used with any linear code and best results are obtained for 
codes which have the highest known dmin for a given codelength п and number of 
information symbols К. The best binary codes are tabulated up to length 257 in 
Marcus Grassl’s on line data base [7]. Non-binary codes, for example, ternary codes 
of length up to 243 symbols and GF(4) codes of length up to 256 symbols are also 
tabulated. 

A particularly good class of codes are the binary self-dual, double-circulant codes 
first highlighted in a classic paper by Karlin [8]. For example the (24, 12, 8) extended 
Golay code is included since it may be put in double-circulant form. There is also 
the (48, 24, 12) bordered double-circulant code, based on quadratic residues of the 
prime 47 and the (136, 68, 24) bordered double-circulant code based on quadratic 
residues of the prime 67. These codes are extremal [3] and are doubly even, only 
having codeword weights that are a multiple of 4, and in these cases it is necessary 
that the codelengths are a multiple of 8 [3]. For higher code rates of length greater 
than 256, the best codes are tabulated in [12], and some of these include cyclic codes 
and Goppa codes. 


15.4.1 The (136, 68, 24) Double-Circulant Code 


This code is a bordered double-circulant code based on the identity matrix and 
a matrix whose rows consist of all cyclic combinations, modulo 1 4- x8, of the 
polynomial b(x) defined by 


b(x) 214-x4 xt | хб | x9 4 xl9 lt p 15 lO 07 19 4 х2! 4422 + 423 4.424 4 25 4.426 4 29 


(15.26) 


The Frame Error Rate (FER) of this code using the extended Dorsch decoder with 
a maximum number of codewords limited to 3 x 106 is shown in Fig. 15.1. Also, 
shown in Fig. 15.1 is Shannon's [14] sphere packing bound offset by the loss for 
binary transmission [1], which is 0.19 dB for a code rate of 1. 
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shannon (136,68) bin.fer 
А circ (136,68,24) 


FER 


0.5 1 1.5 2 215 3 3.5 4 
Eb/No [dB] 


Fig. 15.1 FER as a function of M for the double-circulant (136, 68, 24) code using incremental 
correlation decoding compared to the sphere packing bound, offset for binary transmission 


It may be seen from Fig. 15.1 that the performance of the decoder in conjunction 
with the double-circulant code is within 0.2 dB of the best achievable performance 
for any (136, 68) code at 107? FER. Interestingly, there is a significant number of 
maximum likelihood codeword errors which have a Hamming distance of 36 or 40 
from the transmitted codeword. This indicates that a bounded distance decoder would 
not perform very well for this code. At the typical practical operating point of M 
equal to 3.5 dB, the probability of the decoder processing each received vector as 
a maximum likelihood decoder is shown plotted in Fig. 15.2 as a function of the 
number of codewords evaluated. 

Of course to guarantee maximum likelihood decoding, all 2% = 2.95 x 1029 
codewords need to be evaluated by the decoder. Equation (15.21) has been evaluated 
for the double-circulant (136, 68, 24) code in computer simulations, at an Е of 3.5 dB, 
for each received vector and the cumulative distribution derived. Figure 15.2 shows 
that by evaluating 107 codewords per received vector, 6596 of received vectors are 
guaranteed to be maximum likelihood decoded. For the remaining 35% of received 
vectors, although maximum likelihood decoding is not guaranteed, the probability 
is very small that the codeword with the highest correlation is not the transmitted 
codeword or a codeword closer to the received vector than the transmitted codeword. 
This last point is illustrated by Fig. 15.3 which shows the FER performance of the 
decoder as a function of the maximum number of evaluated codewords. 
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Fig. 15.2 Probability of a received vector being maximum likelihood decoded as a function of 
number of evaluated codewords for the (136, 68, 24) code at Б — 3.5 dB 
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| Ordered received signal ‘noise magnitudes at SNR= 2.5dB E 
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Кір. 15.4 An example of received coordinate magnitudes in their solved order for the (136, 68, 24) 
code at e — 2.5 dB for a single received vector 


The detailed operation of the decoder may be seen by considering an example 
of a received vector at ті of 2.5 dB. The magnitudes of the received coordinates, 
ordered in their solved order, is shown in Fig. 15.4. In this particular example, it is not 
possible to solve for ordered coordinates 67 and 68 (in their order prior to solving of 
the parity-check matrix) and so these coordinates are skipped and become coordinates 
68 and 69, respectively, in the solved order. The transmitted bits are normalised with 
magnitudes 1 and the o of the noise is 21.07. The shift in position of coordinate 69 (in 
original position) to 67 (in solved order) is evident in Fig. 15.4. The positions of the 
bits received in error in the same solved order is shown in Fig. 15.5. It may be noted 
that the received bit errors are concentrated in the least reliable bit positions. There 
are a total of 16 received bit errors and only two of these errors correspond to the 
(data) bit coordinates 11 and 34 of the solved G matrix. Evaluation of 107 codewords 
indicates that the minimum value of Y A (Xmin) 15 2213,8, and this occurs for the 640th 
codeword producing a maximum correlation of ~126.2 with Ymax ^: 140. The weight 
Of Zmin is 16 corresponding to the 16 received bit errors. 

In practice, it is not necessary for Y 4 (хі) given by the partial sum equation (15.18) 
to be evaluated for each codeword. In most cases, the weight of the binary vector zi 
is sufficiently high to indicate that this codeword is not the most likely codeword. 
Shown in Fig. 15.6 are the cumulative probability distributions for the weight of 2; 
for the case where x; is equal to the transmitted codeword, and the case where it is not 
equal to the transmitted codeword. Two operating values for x are shown: 3.5 dB 
and 4 dB. Considering the decoding rule that a weight 29 or more for 24 is unlikely to 
be produced by the transmitted codeword means that 95.4% of candidate codewords 
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Fig. 15.5 Received bits showing bit error positions for the same received vector and same order as 
that shown in Fig. 15.4 
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Fig. 15.6 Cumulative probability distributions for the number of bit errors for the transmitted 
codeword and non-transmitted, evaluated codewords for the (136, 68, 24) code 
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may be rejected at this point, and that the partial sum equation (15.18) need only be 
evaluated for 4.696 of the candidate codewords. In reducing the decoder complexity 
in this way, the degradation to the FER performance as a result of rejection of a 
transmitted codeword corresponds to ~3% increase in the FER and is not significant. 


15.4.2 Тһе (255, 175, 17) Euclidean Geometry (EG) Code 


This code is an EG code originally used in hard decision, one-step majority-logic 
decoding by Lin and Costello, Jr. [10]. Finite geometry codes also have applications 
as LDPC codes using iterative decoding with the belief propagation algorithm [9]. 
The (255, 175, 17) code is a cyclic code and its parity-check polynomial p(x) may 
conveniently be generated from the cyclotomic idempotents as described in Chap. 12. 
The parity-check polynomial is 


род-і1--х H Тал оу + х? wea H (15.27) 
+x 4x? Lx 4-х176 +x! + х?? (15.28) 


The FER performance of the code is shown in Fig. 15.7 and was obtained using the 
incremental correlation decoder and is shown in comparison to using the iterative 
decoder. Also shown in Fig. 15.7 is the sphere packing bound offset by the binary 
transmission loss. 


shannon (255,175) bin. fer 
EG (255,175,17) incremental corr.fer 
EG (255,175, 17) | iterative.fer 


0.5 1 1.5 2 25 3 3.5 4 
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Fig. 15.7 FER performance of the (255, 175, 17) EG code using belief propagation, iterative 
decoding, compared to incremental correlation decoding 
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Although this EG code performs well with iterative decoding it is apparent that 
the incremental correlation decoder is able to improve the performance of the code 
for the AWGN channel by 0.45 dB at 107? FER. 


15.4.3 The (513, 467, 12) Extended Binary Goppa Code 


Goppa codes are frequently better than the corresponding BCH codes because there is 
an additional information bit and the Goppa code is only one bit longer than the BCH 
code. For example, the (512, 467, 11) binary Goppa Code has one more information 
bitthan the (511, 466, 11) BCH code and may be generated by the irreducible Goppa 
polynomial 1 + x? + х, whose roots have order 31 which is relatively prime to 511. 
The dnin of the binary Goppa code [12] is equal to twice the degree of the irreducible 
polynomial plus 1 and is the same as the (511, 466, 11) BCH code. The Goppa code 
may be extended by adding an overall parity check, increasing the dmin to 12. 

The FER performance of the extended Goppa code is shown in Fig. 15.8 and was 
obtained using the incremental correlation decoder. Also shown in Fig. 15.8 is the 
sphere packing bound offset by the binary transmission loss. It can be seen that the 
realised performance of the decoder is within 0.3 dB at 107^. 
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Fig.15.8 FER performance of the (513, 467, 12) binary Goppa code using incremental correlation 
decoding 
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Fig. 15.9 FER performance of the (1023, 983, 9) binary BCH code using incremental correlation 
decoding compared to hard decision decoding 


15.4.4 The (1023, 983, 9) BCH Code 


This code is a standard BCH code that may be found in reference text book tables such 
as by Lin and Costello, Jr. [10]. This example is considered here in order to show that 
the decoder can produce near maximum likelihood performance for relatively long 
codes. The performance obtained is shown in Fig. 15.9 with evaluation of candidate 
codewords limited to 106 codewords. At 107? FER, the degradation from the sphere 
packing bound, offset for binary transmission, is 1.8 dB. Although this may seem 
excessive, the degradation of hard decision decoding is 3.6 dB as may also be seen 
from Fig. 15.9. 


15.5 Extension to Non-binary Codes 


The extension of the decoder to non-binary codes is relatively straightforward, and 
for simplicity binary transmission of the components of each non-binary symbol is 
assumed. Codewords are denoted as before by х; but redefined with coefficients, уҙ; 
from GF(2") 


X; = (Voi Xo, Vii X1, У2122,....Уһ-11/Ха-1) (15.29) 
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The received vector r with coordinates ranked in order of those most likely to be 
correct is redefined as 


m-—1 


к= Ж (шыш наш ый (15.30) 
1=0 


so that the received vector consists of n symbols, each with m values. Тһе maximum 
attainable correlation Ymax is straightforward and is given by 


n—1lm-1 


Ya» nj (15.31) 


j=0 1-0 
The hard decided received vector r, 15 redefined as 


п-1 


b=) ex (15.32) 
j-0 


where 6; is the GF(2") symbol corresponding to sign(r;;) for | = 0 to m — 1. 

Decoding follows in a similar manner to the binary case. The received symbols 
are ordered in terms of their symbol magnitudes |, |5 where each symbol magnitude 
is defined as 


т—1 


ісе >л (15.33) 
1=0 


The codeword x is derived from the k coordinates Xn; whose coefficients v,, are the 
GF (2") symbols corresponding to sign(ri;;) for! = 0 tom — 1; for j =O to k — 1 
and then using the solved parity-check equations for the remaining n — k coordinates. 
The vector z; is given by 
Z=b®x@®xX mod GF(2”) (15.34) 
which may be simplified as before to 
7-20 х; mod GF(2") (15.35) 


Denoting the n binary vectors ;;; corresponding to the n GF(2") coefficients of 2; 


Y (x) = Ymax — Ya (x) (15.36) 
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where Үл (x), the shortfall from maximum correlation is given by 


n—l т—1 


Yam) 22 9 У pui x Iryl (15.37) 


j=0 1-0 


In the implementation of the decoder, as in the binary case, the Hamming weight 
of the vector z; may be used to decide whether it is necessary to evaluate the soft 
decision metric given by Eq. (15.37) for each candidate codeword. 


15.5.1 Results for the (63, 36, 13) GF (4) BCH Code 


This is a non-binary BCH code with the generator polynomial g(x) defined by roots 
(o, o, 019, o2, o, 32, 03, 012, 48, а, 020, 017, об, 4, 33, 


a’, a”, a”, о, a6, о ql? o, o, oll, o^, a>} 


incremental bch (63,36,13) 
hard decoded bch (63,36,13 


) 


FER 


Eb/No [dB] 


Fig. 15.10 FER performance of the (63, 36, 13) GF(4) BCH code using incremental correlation 
decoding compared to hard decision decoding 
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The benefit of having GF(4) coefficients is that g(x) does not need to contain the 
roots 


(a^, o6, a>, a”, a”, o? 


which are necessary to constrain g(x) to binary coefficients [12]. Correspondingly, 
the binary version of this BCH code is the lower rate (63, 30, 13) code with 6 less 
information symbols (bits). 

The performance of the (63, 36, 13) GF(4) BCH Code is shown in Fig. 15.10 for 
the AWGN channel using Quadrature Amplitude Modulation (QAM). Also shown 
in Fig. 15.10 is the performance of the code with hard decision decoding. It may 
be seen that at 107^ FER the performance of the incremental correlation decoder is 
2.9 dB better than the performance of the hard decision decoder. 


15.6 Conclusions 


It has been shown that the extended Dorsch decoder may approach maximum like- 
lihood decoding by an incremental correlation approach in which for each received 
vector a partial summation metric is evaluated as a function of low information 
weight codewords. Furthermore, the number of information weight codewords that 
need to be evaluated to achieve maximum likelihood decoding may be calculated 
as an upper bound for each received vector. Consequently, for each received vector 
it is known whether the decoder has achieved maximum likelihood decoding. An 
efficient decoder structure consisting of a combination of hard decision threshold 
decoding followed by partial sum correlation was also described, which enables 
practical decoders to trade-off performance against complexity. 

The decoder for non-binary codes was shown to be straightforward for the AWGN 
channel and an example was described for a GF(4) (63, 36, 13) BCH code using 
QAM to transmit each GF(4) symbol. It is readily possible to extend the decoder to 
other modulation formats by extensions to the incremental correlation of Eq. (15.37) 
although this inevitably involves an increase in complexity. It is hoped that there will 
sufficient interest from the coding community to address this research area. 

Another interesting conclusion is just how well some codes in Brouwer's table 
perform with maximum likelihood decoding. In particular, the (136, 68, 24) double- 
circulant, extremal, self-dual code is shown to be an outstanding code. 

Itseems that the implementation of this type of decoder coupled with the availabil- 
ity of powerful processors will eventually herald a new era in the application of error 
control coding with the re-establishment of the importance of the optimality of codes 
rather than the ease of decoding. Certainly, this type of decoder is more complex than 
an iterative decoder, but the demonstrable performance, which is achievable for short 
codes, can approach theoretical limits for error-correction coding performance such 
as the sphere packing bound. 
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15.7 Summary 


The current day, unobtainable goal of a practical realisation of the maximum like- 
lihood decoder that can be used with any error-correcting code has been partially 
addressed with the description of the modified Dorsch decoder presented in this 
chapter. А decoder based on enhancements to the original Dorsch decoder has been 
described which achieves near maximum likelihood performance for all codes whose 
codelength is not too long. It is a practical decoder for half rate codes having a code- 
length less than about 180 bits or so using current digital processors. The performance 
achieved by the decoder when using different examples of outstanding binary codes 
has been evaluated and the results presented in this chapter. A description of the 
decoder suitable for use with non-binary codes has also been given. An example 
showing the results obtained by the decoder using a (63, 36, 13) GF(4) non-binary 
code for the AWGN channel has also been presented. 
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Chapter 16 
A Concatenated Error-Correction System 
Using е |u|u + v| Code Construction 


16.1 Introduction 


There is a classical error-correcting code construction method where two good codes 
are combined together to form a new, longer code. It is a method first pioneered by 
Plotkin [1]. The Plotkin sum, also known as the |u|u + v| construction method [3], 
consists of one or more codes having replicated codewords to which are added 
codewords from one or more other codes to form a concatenated code. This code 
construction may be exploited in the receiver with a decoder that first decodes one 
or more individual codewords prior to the Plotkin sum from a received vector. The 
detected codewords from this first decoding are used to undo the code concatenation 
within the received vector to allow the replicated codewords to be decoded. The 
output from the overall decoder of the concatenated code consists of the information 
symbols from the first decoder followed by the information symbols from the second 
stage decoder. Multiple codewords may be replicated and added to the codewords 
from other codes so that the concatenated code consists of several shorter codewords 
which are decoded first and the decoded codewords used to decode the remaining 
codewords. It is possible to utilise a recurrent construction whereby the replicated 
codewords are themselves concatenated codewords. It follows that the receiver has 
to use more than two stages of decoding. 

With suitable modifications, any type of error-correction decoder may be utilised 
including iterative decoders, Viterbi decoders, list decoders, and ordered reliability 
decoders, and of particular importance the modified Dorsch decoder described in 
Chap. 15. It is well known that for a given code rate longer codes have better per- 
formance than shorter codes, but implementation of a maximum likelihood decoder 
is much more difficult for longer codes. The Plotkin sum code construction method 
provides a means whereby several decoders for short codes may be used together to 
implement a near maximum likelihood decoder for a long code. 
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16.2 Description of the System 


Figure 16.1 shows the generic structure of the transmitted signal in which the code- 
word of length n; from code и, denoted as 6, is followed by a codeword comprising 
the sum of the same codeword and another codeword from code v, denoted as %, to 
form a codeword denoted as ar of length 2л у. This code construction is well known 
as the |u|u 4- v| code construction [3]. The addition is carried out symbol by symbol 
using the arithmetic rules of the Galois Field being used, namely G F (q). If code и 
is an (n1, kj, di) code with kı information symbols and Hamming distance d; and 
code v is an (п1, k2, d?) code with kz information symbols and Hamming distance 
45, the concatenated code Gear is an (2, kı + k2, d3) code with Hamming distance 
аз equal to the smaller of 2 x d; and d». 

Prior to transmission, symbols from the concatenated codeword are mapped to 
signal constellation points in order to maximise the Euclidean distance between 
transmitted symbols in keeping with current best transmission practice. For example 
see the text book by Professor J. Proakis [4]. The mapped concatenated codeword is 
denoted as 27, and is given by 


Жш = | Ful Zur = | Ful Awl, (16.1) 


where Z, is used to represent .2,у. 

JA, consists of 2 x n; symbols and the first n; symbols аге the nı symbols of 
22 and the second nı symbols are the nı symbols resulting from mapping of the 
symbols resulting from the summation, symbol by symbol, of the nı symbols of 6u, 
and the nı symbols of codeword Ф,. 

The encoding system to produce the concatenated codeword format shown in 
Fig.16.1 is shown in Fig. 16.2. For each concatenated codeword, kı information 
symbols are input to the encoder for the (71, kı, dı) code and nı symbols are produced 
at the output of the encoder and are stored in the codeword buffer A as shown in 
Fig. 16.2. Additionally, for each concatenated codeword, k2 information symbols are 
input to the encoder for the (71, k2, d2) code and nı symbols are produced at the output 
and are stored in the codeword buffer B as shown in Fig. 16.2. The encoded symbols 


<-------------- пі symbols 


ті symbols 


codeword Cu of (n1, k1,d1) code same codeword C, of (n1, 1,91) code 


+ 


codeword C, of (n1, k2,d2) code 


codeword Cu of (n1, k1,d1) code codeword Cu + С 


2n1 symbols TT TT NST 


Fig. 16.1 Format of transmitted codeword consisting of two shorter codewords 
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(n1, k1,d1) codeword map 
encoder buffer A 
codeword 
kı information symbols symbols 
-- 
to 
to 
transmission channel 
codeword symbols 


buffer C 


(n1,k2,d2) codeword 
-- 
encoder buffer B 


Кә information symbols 


Fig. 16.2 Concatenated code encoder and mapping for transmission 


output from the codeword buffer A are added symbol by symbol to the encoded 
symbols output from the codeword buffer B and the results are stored in codeword 
buffer C. The codeword stored in codeword buffer A is 6, as depicted in Fig. 16.1 
and the codeword stored in codeword buffer C is @, + 6, as also depicted in Fig. 16.1. 
The encoded symbols output from the codeword buffer A are mapped to transmission 
symbols and transmitted to the channel, and these are followed sequentially by the 
symbols output from the codeword buffer C which are also mapped to transmission 
symbols and transmitted to the channel as shown in Fig. 16.2. 

After transmission through the communications medium each concatenated 
mapped codeword is received as the received vector, denoted as Zeat and given 
by 


К = 1212,4] = KA 


Жы. 


(16.2) 


Codeword Ф, is decoded first as shown in Fig. 16.3. It is possible by comparing the 
received samples 2, with the received samples 4, ,, that the a priori log likelihoods 
of the symbols of Z, may be determined, since it is clear that the difference between 
the respective samples, in the absence of noise and distortion, is attributable to %,. 
This is done by the soft decision metric calculator shown in Fig. 16.3. 

Binary codeword symbols are considered with values which are either O or 1. 
The 1% transmitted sample, Х, = (—1)€" and the n, + i transmitted sample, 
Ха = (= 10” х(-1)04. Itis apparent that Х,, and C,, may be derived from Х,,. 
and Хи. 

An estimate of X,, and C,, may be derived from R,, and R,,+,,. First: 


X, = Xu, х Хаду = (DS! х -D9 x(-09 -(-09 (16.3) 
Second, in the absence of distortion and with Gaussian distributed additive noise with 


standard deviation с, and normalised signal power, the log likelihood that С„ = 0, 
Іле (Cy, = 0) is given by 


Ry Ri, v Ry, = В, Е 
Гог(С, = 0) = log Ё ( = Я ia -)| log E (5m) 
с с 


(16.4) 
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kı + Ко information symbols 


kı information symbols 


Fig. 16.3 Decoder for the concatenated code with the codeword format shown in Fig. 16.1 


The soft decision metric calculator, shown in Fig. 16.3, calculates these log likeli- 
hoods according to Eq. (16.4) and these are input to the decoder A shown in Fig. 16.3. 
The decoder A determines the most likely codeword %; of the (n, k2, d2) code. With 
the knowledge of the detected codeword, 6, the received samples Z,,,, which are 
stored in the nı symbols buffer B, are remapped to form 2; by multiplying 4, 
by 25. 


s = Busy х 25. (16.5) 


This remapping function is provided by the remapper shown in Fig. 16.3. The output 
of the remapper is 22. If the decoder's output is correct, 6; = @, and there are now 
two independent received versions of the transmitted, mapped codeword 6y, %; and 
the original received Z,. Both of these are input to the soft metric combiner shown 
in Fig. 16.3, Z; from the output of the remapper and 4, from the output of the n, 
symbols buffer A. 

The soft metric combiner calculates the log likelihood of each bit of 6u, Cu, from 
the sum of the individual log likelihoods: 


266 4 2 Ri, 
О 


Liog (Cu; = 0) = (16.6) 


o?" 
These log likelihood values, Liog(Cu;, = 0), output from the soft metric combiner 
shown in Fig. 16.3 are input to the decoder B. The output of Decoder В is ће kı 
information bits of the detected codeword 6h of the (nı, k1, di) code, and these 
are input to the information symbols buffer shown in Fig. 16.3. The other input to 
the information symbols buffer is the k2 information bits of the detected codeword 
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2n; symbols  ———————————————— 2n; symbols 


codeword Cu of (2n1,k1,d1) code same codeword C, of (2n1,k1,d1) code 


+ 


codeword Cu of (n1, k1,d1) code codeword Cu + Cu, codeword Cu +С» 


Ат symbols 


Fig. 16.4 Format of transmitted codeword consisting of three shorter codewords 


6, of the (nı, k2, d2) code, provided at the output of decoder A. The output of the 
information symbols buffer, for each received vector, is the Кі + k2 information 
bits which were originally encoded, provided both decoders’ outputs, A and B, are 
correct. 

In similar fashion to previous constructions, Fig. 16.4 shows the format of a con- 
catenated codeword of length 4 x n; symbols consisting of three shorter codewords. 
The codeword of length 2 x n; from a (27, kı, dı), code и, denoted as Ф„, is repli- 
cated as shown in Fig. 16.4. The first half of the replicated codeword, 6 6,, is added 
to the codeword @;,; and the second half of the replicated codeword, @;,, is added to 
the codeword Фә, as shown іп Fig. 16.4. Each codeword Фуд and Фу is the result of 
encoding kz information symbols using code v, a (п, k2, d2) code. The concatenated 
codeword that results, Ф ш. is from a (4л1,11 + 2k», d3) concatenated code where 
аз is the smaller of 2d; or do. 

The decoder for the concatenated code with codeword format shown in Fig. 16.4 
is similar to the decoder shown in Fig. 16.3 except that following soft decision metric 
calculation each of the two codewords @,, апа Ф„ are decoded independently. With 
the knowledge of the detected codewords, 6, and @%,, the received samples Z,,,,,, 
which are buffered, are remapped to form the first nı symbols of Z; by multiplying 
Фу by Zh, and the second n; symbols of Z; are obtained by multiplying #,+,, 
by 25, .The two independent received versions of the transmitted, mapped codeword 
Cu, Za and the original received 2, are input to a soft metric combiner prior to 
decoding the codeword 62. 

In another code arrangement, Fig. 16.5 shows the format of a concatenated code- 
word of length 3 x n; symbols. The concatenated codeword is the result of three 
layers of concatenation. A codeword of length n; from a (n1, k1, dı), code u, denoted 
as ©, is replicated twice, as shown in Fig. 16.5. A second codeword of length nı from 
а (пі, k2, d2), code v, denoted as 6, is replicated and each of these two codewords is 
added to the two replicated codewords 6„, as shown in Fig. 16.5. A third codeword 
of length n; from a (n, ks, d3), code w, denoted as 6, is added to the codeword 
summation Ф„ + ©, as shown in Fig. 16.5. The concatenated codeword that results, 
Ceat, is from a (Злу, Кү + Ко + k3, d4) concatenated code where d4 is the smallest of 
3d, or 2d» or d3. 
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ті symbols --------------- пу symbols ті symbols — 
codeword Cy same codeword Cu same codeword Cu 


+ 


+ 
+ 


codeword Cu codeword Cu +С same codeword Cu + C, 


codeword Cy, codeword Cu +С» codeword Cu +Cy +С 


Fig. 16.5 Format of transmitted codeword consisting of two levels of concatenation and three 
shorter codewords 


2nı symbols  ——————————————- 2n, symbols 


codeword Cu codeword Cu +Cy same concatenated codeword [Cu;Cu +С] 


codeword Cy of (2n1,k3,d3) code 


codeword Cy, codeword Cy +Cy codeword [Cu;Cu + Cu] +Cw 


4nı symbols 


Fig. 16.6 Format of transmitted codeword after two stages of concatenation 


The decoder for the three layered concatenated code with codeword format shown 
in Fig. 16.5 uses similar signal processing to the decoder shown in Fig. 16.3 with 
changes corresponding to the three layers of concatenation. The codeword Фу, is 
decoded first following soft decision metric calculation using (ће2, 4, and ZZ, +» 
sections of the received vector. The detected codeword 6% is used to obtain two 
independent received versions of the transmitted, mapped result of the two code- 
words summation @;,+,, 2,1, and the original received %,+,. These are input to a 
soft metric combiner and the output is input to the soft decision metric calculation 
together with Z,, prior to decoding of codeword @. With the knowledge of code- 
word %, remapping and soft metric combining is carried out prior to the decoding 
of codeword 4; . 

Figure 16.6 shows the format of a concatenated codeword of length 4 x пі sym- 
bols. The concatenated codeword is the result of three layers of concatenation. A 
concatenated codeword with the format shown in Fig. 16.1 is replicated and added to 
a codeword, Gj, of length 21; symbols from a (271, кз, аз) code to form a codeword 
of an overall concatenated code having parameters (4n, Ку + k2 + Кз, d4), where d4 
is equal to the smallest of 4d), 2d» or d3. 

The decoder for the three layered concatenated code with codeword format shown 
in Fig. 16.6 is similar to the decoder described above. Codeword Фу, is detected 
first following soft decision metric calculation using 2, and Z„+y sections of the 
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received vector as one input and ће Z, ,,, and ££, уу sections of the received vector 
as the other input. The detected codeword 6% is used to obtain two independent 
received versions of the concatenated codeword of length 2n; symbols with format 
equal to that of Fig. 16.1. Accordingly, following soft metric combining of the two 
independent received versions of the concatenated codeword of length 2n; symbols, 
a vector of length equal to 27; symbols is obtained which may be input to the 
concatenated code decoder shown in Fig. 16.3. This decoder provides at its output 
the kı + ky detected information symbols which together with the Аз information 
symbols already detected provide the complete detected output of the overall three 
layer concatenated code. 

Any type of code, binary or non-binary, LDPC, Turbo or algebraically constructed 
code, may be used. Any corresponding type of decoder, for example an iterative 
decoder or a list decoder may be used. As an illustration of this, Decoder A and 
Decoder B, shown in Fig. 16.3, do not have to be the same type of decoder. 

There are particular advantages in using the modified Dorsch decoder, described 
in Chap. 15, because the Dorsch decoder may realise close to maximum likelihood 
decoding, with reasonable complexity of the decoder. The complexity increases 
exponentially with codelength. Using modified Dorsch decoders. Both decoder A 
and decoder B shown in Fig. 16.3 operate on nı received samples and may realise 
close to maximum likelihood decoding with reasonable complexity even though the 
concatenated codelength is 2 x n; symbols and the total number of received samples 
is 2 x n; samples. Using a single modified Dorsch decoder to decode the 2 x nı sam- 
ples of the concatenated code directly will usually result in non-maximum likelihood 
performance unless the list of codewords evaluated for each received vector is very 
long. For example, a modified Dorsch decoder with moderate complexity, typically 
will process 100,000 codewords for each received vector and realise near maximum 
likelihood performance. Doubling the codelength will require typically in excess of 
100,000,000 codewords to be processed for each received vector if near maximum 
likelihood performance is to be maintained. 

An example of the performance that may be achieved is shown in Fig. 16.7 for the 
concatenated codeword format shown in Fig. 16.1. The encoder used is the same as 
that shown in Fig. 16.2 and the concatenated code decoder is the same as that shown 
in Fig. 16.3. The results were obtained by computer simulation using Quaternary 
Phase Shift Keying (QPSK) modulation and featuring the Additive White Gaussian 
Noise (AWGN) channel. The decoder error rate, the ratio of the number of incorrect 
codewords output by the decoder to the total number of codewords output by the 
decoder, is denoted by the Frame Error Rate (FER) and this is plotted against 7 B 
the ratio of the energy per information bit to the noise power spectral density. Binary 
codes are used and the length of the concatenated code is 256 bits. For best results, 
it is important to use outstanding codes for the constituent codes, particularly for 
code v which is decoded first. In this example, code и is the (128,92,12) extended 
Bose Chaudhuri Hocquenghem (BCH) code. Code v is the (128,36,36) extended 
cyclic code, an optimum code described in [5] by D. Schoemaker and M. Wirtz. 
The (128,36,36) extended cyclic code is not an extended BCH code as it has roots 
{1, 3, 5, 7, 9, 11, 13, 19, 21, 27, 43, 47, 63}. The minimum Hamming distance 
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Fig. 16.7 The error rate performance for a (256,128,24) concatenated code compared to iterative 
decoding of a (256,128,15) Turbo code and a (256,128,12) LDPC code 


of the concatenated code is 2d; = 24. Both decoder A and decoder В, as shown 
in Fig. 16.3, are a modified Dorsch decoder and for both code u and code v, near 
maximum likelihood performance is obtained with moderate decoder complexity. 
For each point plotted in Fig. 16.7, the number of codewords transmitted was chosen 
such that were at least 100 codewords decoded in error. 

Also shown in Fig. 16.7 is the performance of codes and decoders designed accord- 
ing to the currently known state of the art in error-correction coding that is Low 
Density Parity Check (LDPC) codes using Belief Propagation (BP) iterative decod- 
ing, and Turbo codes with BCJR iterative decoding. Featured in Fig. 16.7 is the 
performance of an optimised Low Density Parity Check (LDPC) (256,128,12) code 
using BP, iterative decoding and an optimised (256,128,15) Turbo code with iter- 
ative decoding. As shown in Fig. 16.7 both the (256,128,15) Turbo code and the 
(256,128,12) LDPC code suffer from an error floor for A values higher than 3.5dB 
whilst the concatenated code features a FER performance with no error floor. This is 
attributable to the significantly higher minimum Hamming distance of the concate- 
nated code which is equal to 24in comparison P 15 for the Turbo code and 12 for 
the LDPC code. Throughout the entire range of 22 > values the concatenated code сап 
be seen to outperform the other codes and decodes 

For (512,256) codes, using the concatenated code arrangement, the performance 
achievable is shown in Fig. 16.8. The concatenated code arrangement uses the 
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Fig. 16.8 Comparison ofthe error rate performance for a (512,256,32) concatenated code compared 
to iterative decoding of a (512,256,18) Turbo code and a (512,256,14) LDPC code 


concatenated codeword format which is shown in Fig. 16.4. As before, the FER 
results were obtained by computer simulation using QPSK modulation and the 
AWGN channel. Both codes v, and у» are the same апа equal to the outstanding 
(128,30,38) best-known code [6]. Code u is equal to a (256,196,16) extended cyclic 
code. Featured in Fig.16.8 is the performance of an optimised Low Density Par- 
ity Check (LDPC) (512,256,14) code using BP iterative decoding and an optimised 
(512,256,18) Turbo code with iterative decoding. For each point plotted in Fig. 16.8, 
the number of codewords transmitted was chosen such that were at least 100 code- 
words decoded in error. As shown in Fig. 16.8 both the (512,256,18) Turbo code 
and the (512,256,14) LDPC code suffer from an error floor for LA values higher 
than 3.4 dB whilst the concatenated code features a FER performance with no error 
floor. As before this is attributable to the significantly higher minimum Hamming 
distance of the concatenated code which is equal to 32in comparison to 18 for the 
Turbo code and 14 for the LDPC code. Throughout the entire range of M values, the 
concatenated code system can be seen to outperform the other coding arrangements 
for (512,256) codes. 
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16.3 Concatenated Coding and Modulation Formats 


With the |u|u 4- v| code construction and binary transmission, the received vector 
for the codeword of code v suffers the full interference from the codeword of code 
и because it is transmitted as и + v. The interference is removed by differential 
detection using the first version of the codeword of code u. However, although the 
effects of code u are removed, differential detection introduces additional noise power 
due to noise times noise components. One possible solution to reduce this effect is 
to use multi-level modulation such as 8-PSK. Code и is transmitted as 4-Р5К and 
code v modulates the 4-PSK constellation by +22.5 degrees. Now there is less direct 
interference between code u and code v. Initial investigations show that this approach 
18 promising, particularly for higher rate systems. 


16.4 Summary 


Concatenation of good codes is a classic method of constructing longer codes which 
are good. As codes are increased in length, it becomes progressively harder to realise 
a near maximum likelihood decoder. This chapter presented a novel concatenated 
code arrangement featuring multiple near maximum likelihood decoders for an opti- 
mised matching of codes and decoders. It was demonstrated that by using some 
outstanding codes as constituent codes, the concatenated coding arrangement is able 
to outperform the best LDPC and Turbo coding systems with the same code para- 
meters. The performance of a net (256,128) code achieved with the concatenated 
arrangement is compared to a best (256,128) LDPC code and a best (256,128) Turbo 
code. Similarly, the performance of a (512,256) net concatenated code is compared 
to a best (512,256) LDPC code and a best (512,256) Turbo code. In both cases, the 
new system was shown to outperform the LDPC and Turbo systems. To date, for 
the AWGN channel and net, half rate codes no other codes or coding arrangement is 
known that will outperform the system presented in this chapter for codes of lengths 
256 and 512 bits. 
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Part IV 
Applications 


This part is concerned with a wide variety of applications using error-correcting 
codes. Analysis is presented of combined error-detecting and error-correcting codes 
which enhance the reliability of digital communications by using the parity check bits 
forerror detection as well as using the parity check bits for error-correction. A worked 
example of code construction for a (251, 113, 20) incremental redundancy error- 
correcting code is described. The idea is that additional sequences of parity bits may 
be transmitted in stages until the decoded codeword satisfies a Cyclic Redundancy 
Check (CRC). A soft decision scheme for measuring codeword reliability is also 
described which does not require a CRC to be transmitted. The relative performance 
of the undetected error rate and throughput of the different systems is presented. 

In this part it is also shown that error-correcting codes may be used for the auto- 
matic correction of small errors in password authentication systems or in submitting 
personal identification information. An adaptive mapping of GF (q) symbols is used 
to convert a high percentage of passwords into Reed-Solomon codewords without 
the need for additional parity check symbols. It is shown that a BCH decoder may be 
used for error-correction or error detection. Worked examples of codes and passwords 
are included. 

Goppa codes are used as the basis of a public key cryptosystem invented by Pro- 
fessor Robert McEliece. The way in which Goppa codes are designed into the cryp- 
tosystem is illustrated with step by step worked examples showing how a ciphertext 
is constructed and subsequently decrypted. The cryptosystem is described in con- 
siderable detail together with some proposed system variations designed to reduce 
the ciphertext length with no loss in security. An example is presented in which the 
system realises 256 bits of security, normally requiring a ciphertext length of 8192 
bits, that uses a ciphertext length of 1912 bits. 

Different attacks, designed to break the McEliece cryptosystem are described 
including the information set decoding attack. Analysis is provided showing the 
security level achieved by the cryptosystem as a function of Goppa code length. 
Vulnerabilities of the standard McEliece to chosen plaintext and chosen ciphertext 
attacks are described, together with system modifications that defeat these attacks. 
Some commercial applications are described that are based on using a smartphone 
for secure messaging and cloud based, encrypted information access. 
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The use of error-correcting codes in impressing watermarks on different media by 
using dirty paper coding is included in this part. The method described, is based on 
firstly decoding the media or white noise with a cross correlating decoder so as to find 
sets of codewords from a given code that will cause minimum change to the media, 
but still be detectable. The best codewords are added to the media as a watermark so 
as to convey additional information as in steganography. Some examples are included 
using a binary (47, 24, 11) quadratic residue code. 


Chapter 17 
Combined Error Detection 
and Error-Correction 


17.1 Analysis of Undetected Error Probability 


Let the space of vectors over a field with 4 elements Е, of length n be denoted by F7. 
Let [n, k, d], denote a linear code over F; of length n symbols, dimension k symbols 
and minimum Hamming distance d. We know that a code with minimum Hamming 
distance d can correct t = | (d — 1)/2| errors. It is possible for an [n, k, d = 2t 4-1]; 
linear code, which has q"-* syndromes, to use a subset of these syndromes to correct 
т « 1 errors and then to use the remaining syndromes for error detection. For 
convenience, let @ denote an [n, k, d], linear code with cardinality |@|, and let a 
codeword оҒ% be denoted by e; = (со, ci 1. ..., CL a1), Where 0 <1 < |. 

Consider a codeword c;, for some integer i, which is transmitted over a q-ary 
symmetric channel with symbol transition probability p/(q — 1). At the receiver, a 
length n vector y is received. This vector y is not necessarily the same as c; and, 
denoting dg (a, b) as the Hamming distance between vectors а and b, the follow- 
ing possibilities may occur assuming that nearest neighbour decoding algorithm is 
employed: 


1. (no error) dy (y, ci) < т and y is decoded as с;; 
2. (error) їн (у, cj) > t for0 < j< |@|; and 
3. (undetected error) ан (y, cj) x t for j Ai and y is decoded as с; 


Definition 17.1 А sphere of radius centered at a vector v € F}, denoted by 5 : (у), 
is defined as 


S, (v) = {w | мін(у- w) < t for all w € ҒИ). (17.1) 


Itcan be seen that, in an error-detection-after-correction case, 55 (с) may be drawn 
around all |] codewords of the code @. For any vector falling within 54 (с), the 
decoder returns c the corresponding codeword which is the center of the sphere. It 
is worth noting that all these || spheres аге pairwise disjoint, i.e. 
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LJ 5с) 182) = 0. 
0<і,/<1“І 
ij 
In a pure error-detection scenario, the radius of these spheres is zero and the proba- 
bility of an undetected error is minimised. When the code is used to correct a given 
number of errors, the radius increases and so does the probability of undetected error. 


Lemma 17.1 The number of length n vectors over F, of weight j within a sphere 
of radius т centered at a length n vector of weight i, denoted by № (п, i, j), is equal 
to 


eu ôu . . 


e=e, =ô, 


where ер = max(0,i — j), ey = min(r, t +i — j), ôL = max(0,i — j) and 
ôy = min(e, t +i —j—e,n- j). 


Proof Let и be a vector of weight i and let sup(u) and sup(u) denote the support of 
и, and the non-support of и, respectively, that is 


sup(u) = {i | u; 40, Юг0<і<п-1) 
sup(u) = (0, 1, ...,n — 1}\ sup(u). 


A vector of weight j, denoted by v, may be obtained by adding a vector w, which 
has e coordinates which are the elements of sup(u) and f coordinates which are the 
elements of sup(u). In the case where q > 2, considering the coordinates in sup(u), 
it is obvious that vector v = и + w can have more than i — e non-zeros in these 
coordinates. Let 6, where 0 < 6 < e, denote the number of coordinates for which 
v; = 0 among sup(u) of v, i.e. 


ô = | sup(u)\ (sup(u) N ѕир(у)) | 


where i € sup(u). For each way, there are (E 5) (q - 2) ways to generate e — à 
non-zeros in the coordinates sup(u) N sup(w) such that у; 3 0. It follows that 
f-j-Gü-—e)—(e—-8)—j-—i--óandthere are (a — 1/7 ^*? ways to 
generate f non-zero coordinates such that v; 4 0 where i є sup(u). Therefore, for 
given integers e and ô, we have 


iX fe п-і і-З9%(,- әуе 
OOC )«- a э ana 


vectors w that produce wty(v) = j. Note that (,°,) = (5). 


Given an integer e, there are ( ) ways to generate e coordinates for which w; 4 0 
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It is obvious that O < e, f < t and e + f < т. In the case of j < i, the integer e 
may not take the entire range of values from 0 to т, itis not possible to have e < i — j. 
On the other hand, for j > i, the integer e > 0 and thus, the lower limit on the value 
of e is ег = max(0, i — j). The upper limit of e, denoted by ey, is dictated by the 
condition e + f = т. For j < i, ey = т since for any value of e, ô may be adjusted 
such that wtg (v) = j. For the case j > i, f > 0 and for any value of e, there exists 
at least one vector for which ô = 0, implying ey = t — f = t +i — j. It follows 
that ey = min(t, т +i — j). 

For a given value of e, 5 takes certain values in the range between 0 and e such 
that wty(v) = j. The lower limit of 6 is obvious бу = ez. The upper limit of ô 
for j > i case is also obvious, dy = е, since f > 0. For the case j < i, we 
have e + f = e + (j —i+6y) € т, implying бу < t — e + i — j. In addition, 
n—i > j— i+ ôy and thus, we have ôy = min(e, t — e +i — j,n— j). 


Corollary 17.1 For q = 2, we һауе 


Ш]. п—1 
№ (п, і, j) = 17.4 
3 (n, i, j) 2 ШЕР (17.4) 


е--тах(0,4-/) 


Proof For д = 2, it is obvious that 6 = e and 0° = 1. Since e + f < тапа 
f = ј – і + е, ће upper limit of e, ez, becomes е, < | (т +i — j)/2]. 


Theorem 17.1 For an [n, k, d = 21 + 1], linear code ©, the probability of unde- 
tected error after correcting at most т errors, where т < t, in a q-ary symmetric 
channel with transition probability p/(q — 1), is given by 


n і+т і 
BG p= > Ar >, NO 3 (2) (1 — py (17.5) 
і-а 


j=i-t 


where A; is the number of codewords of weight i іп € and N, (n, i, j) is given in 
Lemma 17.1. 


Proof An undetected error occurs if the received vector falls within a sphere of 
radius т centered at any codeword @ except the transmitted codeword. Without loss 
of generality, as the code is linear, the transmission of the all zeros codeword may 
be assumed. Consider с; a codeword of weight i >> 0, all vectors within 54 (с;) һауе 
weights ranging from i — т to i 4- т with respect to the transmitted all zeros codeword. 
For each weight j in the range, there are N; (n, i, j) such vectors in the sphere. 


Following [2], if B; denotes the number of codewords of weight j in 4, the dual 
code of ©, A j тау be written as 


1 n 
Am = cop 2,8 Рп, m,i) (17.6) 
i=0 


ez 
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where 


p mo Sco 1) (077) (17.7) 
j-0 


J т- j 


is а Krawtchouk polynomial. Using (17.6) and (17.7), the probability of undetected 
error after error-correction (17.5) may be rewritten in terms of the weight of the 
codewords in the dual code. 


17.2 Incremental-Redundancy Coding System 


17.2.1 Description of the System 


The main area of applications is two-way digital communication systems with par- 
ticular importance to wireless communication systems which feature packet digital 
communications using a two-way communications medium. In wireless communica- 
tions, each received packet is subject to multipath effects and noise plus interference 
causing errors in some of the received symbols. Typically forward error-correction 
(FEC) is provided using convolutional codes, turbo codes, LDPC codes, or algebraic 
block codes and at the receiver a forward error-correction decoder is used to correct 
any transmission errors. Any residual errors are detected using a cyclic redundancy 
check (CRC) which is included in each transmitted codeword. The CRC is calculated 
for each codeword that is decoded from the corresponding received symbols and if 
the CRC is not satisfied, then the codeword is declared to be in error. If such an error is 
detected, the receiver requests the transmitter by means of a automatic repeat request 
(ARQ) either to retransmit the codeword or to transmit additional redundant symbols. 
Since this is a hybrid form of error-correction coupled with error-detection feedback 
through the ARQ mechanism, it is commonly referred to as a hybrid automatic repeat 
request (HARQ) system. 

The two known forms of HARQ are Chase combining and incremental redun- 
dancy (IR). Chase combining is a simplified form of HARQ, wherein the receiver 
simply requests retransmission of the original codeword and the received symbols 
corresponding to the codeword are combined together prior to repeated decoding 
and detection. IR provides for a transmission of additional parity symbols extending 
the length of the codeword and increasing the minimum Hamming distance, dmin 
between codewords. This results in a lower error rate following decoding of the 
extended codeword. The average throughput of such a system is higher than a fixed 
code rate system which always transmits codewords of maximum length and redun- 
dancy. In HARQ systems, it is a prerequisite that a reliable means be provided to 
detect errors in each decoded codeword. A system is described below which is able 
to provide an improvement to current HARQ systems by providing a more reliable 
means of error detection using the CRC and also provides for an improvement in 
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Fig. 17.1 Codeword format for conventional incremental-redundancy ARQ schemes 


throughput by basing the error detection on the reliability of the detected codeword 
without the need to transmit the CRC. 

Figure 17.1 shows the generic structure of the transmitted signal for a punctured 
codeword system. The transmitted signal comprises the initial codeword followed by 
additional parity symbols which are transmitted following each ARQ request up to a 
total of M transmissions for each codeword. АП of the different types of codes used in 
HARQ systems: convolutional codes, turbo codes, LDPC codes, and algebraic codes 
can be constructed to fit into this generic codeword structure. As shown in Fig. 17.1, 
the maximum length of each codeword is пм symbols transmitted in a total of M 
transmissions resulting from the reception of M — 1 negative ACK's (NACK’s). 
The first transmission consists of т information symbols encoded into a total of 
пі symbols. There аге rı parity symbols in addition to ће CRC symbols. This is 
equivalent to puncturing the maximum length codeword in the last n y — nı symbols. 
If this codeword is not decoded correctly, a NACK is received by the transmitter, 
(indicated either by the absence of an ACK being received or by a NACK signal 
being received), and rz parity symbols are transmitted as shown in Fig. 17.1. 

The detection of an incorrect codeword is derived from the CRC in conventional 
HARQ systems. After the decoding ofthe received codeword, the CRC is recalculated 
and compared to the CRC symbols contained in the decoded codeword. If there is 
no match, then an incorrect codeword is declared and a NACK is conveyed to the 
transmitter. Following the second transmission, the decoder has a received codeword 
consisting of nı + r2 symbols which are decoded. The CRC is recalculated and 
compared to the decoded CRC symbols. If there is still no match, a NACK is conveyed 
to the transmitter and the third transmission consists of the ғҙ parity symbols and 
the net codeword consisting of n; + r2 + r3 symbols is decoded, and so on. The IR 
procedure ends either when an ACK is received by the transmitter or when a codeword 
of total length ny symbols has been transmitted in a total of M transmissions. 

Most conventional HARQ systems first encode the т information symbols plus 
CRC symbols into a codeword of length ny symbols, where бу = [ny,k, dy] 
denotes this code. The code «у is then punctured by removing the last ny — ny_ 
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symbols to produce a code бу = [ny_1,k, Яу_1], the code @y_, is then punc- 
tured by removing the last пм—1 — ny» symbols to produce a code @y_2, and so 
forth until a code €, = [n;, k, dı] is obtained. In this way, a sequence of codes 
«€, = [ni k, di], © = [no, k, do], ..., Фи = (пм, k, dy] is obtained. In the first 
transmission stage, a codeword @ is transmitted, in the second transmission stage, 
the punctured parity symbols of @ is transmitted and so on as shown in Fig. 17.1. 

An alternative IR code construction method is to produce a sequence of codes 
using a generator matrix formed from a juxtaposition of the generator matrices of a 
nested block code. In this way, no puncturing is required. 

Figure 17.2 shows the structure of the transmitted signal. The transmitted signal 
formatis the same as Fig. 17.1 exceptthat no CRC symbols are transmitted. The initial 
codeword consists only of the m information symbols plus the rı parity symbols. 
Additional parity symbols are transmitted following each ARQ request up to a total 
of M transmissions for each codeword. АП of the different types of codes used in 
HARQ systems: convolutional codes, turbo codes, LDPC codes, and algebraic codes 
may be used in this format including the sequence of codes based on a nested block 
code construction. 

Figure 17.3 shows a variation of the system where the k information symbols, 
denoted by vector u, are encoded with the forward error-correction (FEC) encoder 
into ny symbols denoted as cy which are stored in the transmission controller. In the 
first transmission, nı symbols are transmitted. At the end of the ith stage, a codeword 
of total length п; symbols has been transmitted. This corresponds to a codeword of 
length пм symbols punctured in the last ny — n; symbols. In Fig. 17.3, the codeword 
of length п; is represented as a vector v, which is then passed through the channel to 
produce y' and buffered in the Received buffer as y which is forward error-correction 
(FEC) decoded in the FEC decoder which produces the most likely codeword сі and 
the next most likely codeword c;. 
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Fig. 17.3 The incremental-redundancy ARQ scheme with adjustable reliability without using a 
CRC 


Let us consider that the ІК system has had i transmissions so that a total of л; 
symbols have been received and the total length of the transmitted codeword is n; 
symbols. 

сі is denoted as 


су = cio + cux + eiox? + ex? + cux + eg gx (17.8) 
and c» is denoted as 
єз = сю + сәх + ex? + coax? + содх ena xd (17.9) 
and the received symbols y are denoted as 
Y = yo + yix + yx? + yx? + yaxa С Yon )20' 7! (17.10) 
For each decoded codeword, c, and c5, the squared Euclidean distances di (y. €1) 
and й. (у, с>) respectively are calculated between ће codewords and the received 


symbols y stored in the Received buffer. 
d? (y, cı) is given by 


nj—l 


dz(y ei) = YO; = с) (17.11) 
1-0 
d? (y, с>) is given by 
ni—1l 
di(y.e3) = >. (yj — e (17.12) 


j-0 
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The function of the Reliability estimator shown in Fig. 17.3 is to determine how 
much smaller is аг. (у, c1) compared to а“ У, сә) in order to estimate the likelihood 
that the codeword c, is correct. The Reliability estimator calculates the squared 
Euclidean distances d? (y, ст) and di (у, с>), and determines the difference A given 
by 


А-а (у, €) — dz (y. c1) (17.13) 


A is compared to a threshold which is calculated from the minimum Hamming 
distance of the first code in the sequence of codes, the absolute noise power, and 
a multiplicative constant, termed к. As shown in Fig.17.3, A is compared to the 
threshold by the Comparator. If A is not greater than the threshold, c; is considered 
to be insufficiently reliable, and the output of the comparator causes the ACK/NACK 
generator to convey a NACK to the transmitter for more parity symbols to be trans- 
mitted. If A is greater than or equal to the threshold then c, is considered to be 
correct, the output of the comparator causes the ACK/NACK generator to convey an 
ACK to the transmitter and in turn, the ACK/NACK generator causes the switch to 
close and c, is switched to the output й. The ACK causes the entire IR procedure to 
begin again with a new vector u. The way that A works as an indication of whether 
the codeword c, is correct or not. If c; is correct, then аг. (у,сі) is a summation 
of squared noise samples only because the signal terms cancel out. The codeword 
с> differs from c, in a number of symbol positions equal to at least the minimum 
Hamming distance of the current code, dmin. With the minimum squared Euclidean 
distance between symbols defined as 22, A will be greater or equal to djnin x 42 plus 
a noise term dependent on the signal to noise ratio. If сі is not correct d? (y, ст) and 
аг. (y, c2) will be similar and A will be small. 

If more parity symbols are transmitted because A is less than the threshold, the 
dmin Of the code increases with each increase of codeword length and provided c, is 
correct, A will increase accordingly. 

The Reliability measure shown in Fig. 17.3 uses the squared Euclidean distance 
but itis apparent that equivalent soft decision metrics including cross-correlation and 
log likelihood may be used to the same effect. 

In the system shown in Fig. 17.4 а СКС is transmitted in the first transmitted 
codeword. The т information symbols, shown as vector и in Fig. 17.4 are encoded 
with the СКС encoder to form a total of К symbols, shown as vector x. Тһе К 
symbols are encoded by the FEC encoder into ny symbols denoted as cy which 
are stored in the transmission controller. In the first transmission, nı symbols are 
transmitted. At the end of the ith stage, а codeword of total length п; symbols has 
been transmitted. This corresponds to a codeword of length пм symbols punctured 
in the last ny — n; symbols. In Fig. 17.4, the codeword of length n; is represented 
as a vector v, which is then passed through the channel to produce y' and buffered 
in the Received buffer as y, which is forward error-correction (FEC) decoded in the 
FEC decoder. The FEC decoder produces L codewords with decreasing reliability 
as measured by the squared Euclidean distance between each codeword and the 
received symbols or as measured by an equivalent soft decision metric such as cross- 
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Fig. 17.4 The incremental-redundancy ARQ scheme with adjustable reliability using a CRC 


correlation between each codeword and the received symbols. The L codewords are 
input to CRC checking which determines the most reliable codeword, c;, which 
satisfies the CRC and the next most reliable codeword, c;, which satisfies the CRC. 
The Reliability estimator shown in Fig. 17.4 determines the difference, A, of the 
squared Euclidean distances between codewords c; and c; and the corresponding 
received symbols. 

A is given by 


A = dy, ei) — dz (y, ej) (17.14) 


A is compared to a threshold which is calculated from the minimum Hamming 
distance of the first code in the sequence of codes, the absolute noise power, and a 
multiplicative constant termed к. As shown in Fig. 17.4, A is compared to the thresh- 
old by the comparator. If A is not greater than the threshold, c; is considered to be 
insufficiently reliable, and the output of the comparator causes the ACK/NACK gen- 
erator to convey a NACK to the transmitter for more parity symbols to be transmitted. 
If A is greater than or equal to the threshold then c; is considered to be correct, the 
output of the comparator causes the ACK/NACK generator to convey an ACK to the 
transmitter and in turn, the ACK/NACK generator causes the switch to close and с; 
is switched to the output й. The ACK causes the entire IR procedure to begin again 
with a new vector u. 

The Reliability measure shown in Fig. 17.4 uses the squared Euclidean distance 
but it is apparent that equivalent soft decision metrics including cross correlation and 
log likelihood ratios may be used to the same effect. 
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17.211 Code Generation Using Nested Block Codes 


If @ is a cyclic code, then there exists a generator polynomial g(x) е [х] and a 
parity-check polynomial h(x) є F2[x] such that g(x)h(x) = х" — 1. Two cyclic 
codes, 61 with о (x) as the generator polynomial and @ with gz (x) as the generator 
polynomial, are said to be chained or nested, if gı (х) |22(х), and we denote them by 
€ > ©. With reference to this definition, it is clear that narrow-sense BCH codes 
of the same length form a chain of cyclic codes. Given a chain of two codes, using 
a code construction method known as Construction X, a construction method first 
described by Sloane et al. [5], the code with larger dimension can be lengthened to 
produce a code with increased length and minimum distance. 

A generalised form of Construction X involves more than two codes. Let 2; be 
an [n,, kj, di] code, given a chain of M codes, Z D A, D --- D Sy, and a set 
of auxiliary codes .&% = In; ki» dil for 1 <i < M — 1, where ki = kı — ki, a 
code Фу = [n, + oe п, kı, d] can be constructed, where d = min{dy, dy—1 + 
di; tut dy ot dy cht Уул АФ. 

Denoting 2 as a vector of lengh nı formed by the first nı coordinates of a codeword 
of Gy. A codeword of Єў is a juxtaposition of codewords of 2; and .%, where 


( bu 0 |0 |... 0 0 ) ifze By, 
( bua 0 0 fue 0 ам-і ) ifz € Фм-_1, 
( Бм-о 0 0 ... | ам-2 | ам-і ) ifz € dM. 2, 
( bo 0 аә |... | ам-2 | @м-1 ) ifz € Bo, 
( bi а, | а2 |... | ам-2 | d M-1 ) ifz e 21, 


where b; е 2; and aj € 24. 


17.2.1.2 Example of Code Generation Using Nested Block Codes 
There exists a chain of extended BCH codes of length 128 bits, 


BA, = [128, 113, 6] 2.7 = [128, 92, 12] D A”; = [128, 78, 16] > 
Ag = [128, 71, 20]. 


Applying Construction X to [128, 113, 6] > [128,92, 12] with an [32, 21, 6] 
extended BCH code as auxiliary code, a [160, 113, 12] code is obtained, giving 


[160, 113, 12] D [160, 92, 12] D [160, 78, 16] D [160, 71, 20]. 


Additionally, using a [42, 35, 4] shortened extended Hamming code as the auxiliary 
code in applying Construction X to [160, 113, 12] 5 [160, 78, 16], giving 
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[202, 113, 16] D [202, 92, 16] D [202, 78, 16] > [202, 71, 20]. 


Finally, applying Construction X to [202, 113, 16] > [202, 71, 20] with the short- 
ened extended Hamming code [49, 42, 4] as the auxiliary code, giving 


[251, 113, 20] > [251, 92, 20] > [251, 78, 20] > [251, 71, 20]. 
The resulting sequence of codes which are used in this example are [128, 113, 6], 


[160, 113, 12], [202, 113, 16] and [251, 113, 20]. 
The generator matrix of the last code, the [251, 113, 20] code is given by 


(17.15) 


On the left hand side of the double bar, the generator matrix of the code 2) is 
decomposed along the chain 4, D 2 D 23 > B4. The matrices G, for 1 <i < 
3 are the generator matrices of the auxiliary codes %. 

This generator matrix is used to generate each entire codeword of length ny = 251 
bits, but these bits are not transmitted unless requested. The first 128 bits of each 
entire codeword are selected to form the codeword of the code [128, 113, 6] and are 
transmitted first, bit O through to bit 127. The next transmission (if requested by the 
IR system) consists of 32 parity bits. These are bit 128 through to bit 159 of the 
entire codeword. These 32 parity bits plus the original 128 bits form a codeword 
of the [160, 113, 12] code. The next transmission (if requested by the IR system) 
consists of 42 parity bits. These are bit 160 through to bit 201 of the entire code- 
word. These 42 parity bits plus the previously transmitted 160 bits form a codeword 
from the [202, 113, 16] code. The last transmission (if requested by the IR sys- 
tem) consists of 49 parity bits. These are the last 49 bits, bit 202 through to bit 
250, of the entire codeword. These 49 parity bits plus the previously transmitted 
202 bits form a codeword from the [251, 113, 20] code. The sequence of increasing 
length codewords with each transmission (if requested by the IR system) has a min- 
imum Hamming distance which starts with 6, increases from 6 to 12, then to 16 and 
finally, to 20. In turn this will produce an increasing reliability given by Eq. (17.13) 
or (17.14) depending on the type of system. 
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A completely different method of generating nested codes is to use the external 
parity checks, augmentation method first suggested by Goppa in which independent 
columns are added incrementally to the parity-check matrix. The method is described 
in detail in Chap. 6 and can be applied to any Goppa or BCH code. 

In order to be used in the HARQ systems, a FEC decoder is needed that will 
decode these nested block codes. One such universal decoder is the modified Dorsch 
decoder described in Chap. 15 and results using this decoder are presented below. 


17.2.1.3 List Decoder for Turbo and LDPC Codes 


If LDPC or turbo codes are to be used, the HARQ system needs a decoder that pro- 
vides several codewords at its output in order that the difference between the squared 
Euclidean distances (or an equivalent soft decision metric) of the most likely trans- 
mitted codeword and the next most likely transmitted codeword may be determined 
and compared to the threshold. For turbo codes, the conventional decoder is not a 
list decoder but Narayanan and Stuber [3] show how a list decoder may be provided 
for turbo codes. Similarly for LDPC codes, Kristensen [1] shows how a list decoder 
may be provided for LDPC codes. 


17.2.1.4 Performance Results Using the Nested Codes 


Computer simulations using the nested codes constructed above have been carried 
out featuring all three HARQ systems. These systems include the traditional HARQ 
system using hard decision checks of the CRC and the two new systems featuring 
the soft decision, decoded codeword/received vector check, with or without a CRC. 
All of the simulations of the three systems have been carried out using a modified 
Dorsch decoder as described in Chap. 15. The modified Dorsch decoder can be easily 
configured as a list decoder with hard and soft decision outputs. 

For each one of the nested codes, the decoder exhibits almost optimum maximum 
likelihood performance by virtue of its delta correlation algorithm corresponding to 
a total of 106 codewords, that are closest to the received vector, being evaluated each 
time there is a new received vector to input. Since the decoder knows which of the 
nested codes it is decoding, it is possible to optimise the settings of the decoder for 
each code. 

For the CRC cases, an 8 bit CRC polynomial (1 4- x)(1 4- x? 4 x? + x8 + x7) 
was used, the 8 CRC bits being included in each codeword. It should be noted that 
in calculating the throughput these CRC bits are not counted as information bits. 
In the CRC cases, there are 105 information bits per transmitted codeword. In the 
computer simulations, an ACK is transmitted if A is greater than threshold or there 
have been M IR transmissions, otherwise a NACK is transmitted. 

The traditional HARQ system using a CRC is compared to the new system not 
using a CRC in Figs. 17.5 and 17.6. The comparative frame error rate (FER) perfor- 
mance is shown in Fig. 17.5 and the throughput is shown in Fig. 17.6 as a function 
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Fig. 17.5 The error rate performance in comparison to the classical HARQ scheme using a CRC 


of the average rA ratio. The traditional CRC approach shows good throughput, but 
exhibits an early error-floor of the FER, which is caused by undetected error events. 
The FER performance shows the benefit of having increased reliability of error detec- 
tion compared to the traditional CRC approach. Two threshold settings are provided 
using the multiplicative constant к and the effects of these are shown in Figs. 17.5 
and 17.6. It is apparent from the graphs that the threshold setting may be used to 
trade-off throughput against reduced FER. The improvements in both throughput 
and FER provided by the new HARQ systems compared to the conventional HARQ 
system, featuring a hard decision CRC check, are evident from Figs. 17.5 and 17.6. 

The comparative FER performance and throughput with a CRC compared to not 
using a CRC is shown in Figs. 17.7 and 17.8 for the new system where the threshold 
is fixed by к = 1. The new system using a СКС shows an improvement in FER, 


Fig. 17.7, over the entire range of average x and an improvement in throughput, 


Fig. 17.8, also over the entire range of average жа compared to the traditional HARQ 
approach using a CRC. 
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Fig. 17.6 The throughput performance without using a CRC in comparison to the classical HARQ 
scheme using a CRC 


109 


10 i 


10? 


10? 


10 4 


Frame Error Rate 


10° 


109 4 


CRC - Conventional approach 

CRC-less - Thresholding approach (к=1.0) >--е- 

CRC - Thresholding approach (к-1.0) ------- 
I I I I 


10? І 
1 1.5 2 2.5 3 3.5 4 


(EyNo)ayg 


Fig. 17.7 The error rate performance using a CRC in comparison to the classical HARQ scheme 
using a CRC 
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Fig. 17.8 The throughput performance with a CRC in comparison to the classical HARQ scheme 
using a CRC 


17.3 Summary 


This chapter has discussed the design of codes and systems for combined error 
detection and correction, primarily aimed at applications featuring retransmission of 
data packets which have not been decoded correctly. Several such Hybrid Automatic 
ReQuest, HARQ, systems have been described including a novel system variation 
which uses a retransmission metric based on a soft decision; the Euclidean distance 
between the decoded codeword and the received vector. It has been shown that a 
cyclic redundancy check, CRC, is not essential for this system and need not be 
transmitted. 

It has also been shown how to construct the generator matrix of a nested set of 
block codes of length 251 bits by applying Construction X three times in succession 
starting with an extended BCH (128, 113, 6) code. The resulting nested codes have 
been used as the basis for an incremental-redundancy system whereby the first 128 
bits transmitted is a codeword from the BCH code, followed by the transmission of a 
further 32 bits, if requested, producing a codeword from a (160, 113, 12) code. Further 
requests for additional transmitted bits finally result in a codeword from a (251, 113, 
20) code, each time increasing the chance of correct decoding by increasing the 
minimum Hamming distance of the net received codeword. Performance graphs have 
been presented showing the comparative error rate performances and throughputs of 
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the new HARQ systems compared to the standard HARQ system. The advantages of 
lower error floors and increased throughputs are evident from the presented graphs. 
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Chapter 18 
Password Correction and Confidential 
Information Access System 


18.1 Introduction and Background 


Following the trend of an increasing need for security and protection of confiden- 
tial information, personal access codes and passwords are increasing in length with 
the result that they are becoming more difficult to remember correctly. The system 
described in this chapter provides a solution to this problem by correcting small 
errors in an entered password without compromising the security of the access sys- 
tem. Moreover, additional levels of security are provided by the system by associating 
passwords with codewords of an error-correcting code and using a dynamic, user- 
specific, mapping of Galois field symbols. This defeats password attacking systems 
consisting of Rainbow tables because each user transmits what appears to be a ran- 
dom byte stream as a password. A description of this system was first published by 
the authors as a UK patent application in 2007 [1]. 

The system is a method for the encoding and decoding of passwords and the 
encoding and decoding of confidential information which is accessed by use of these 
passwords. Passwords may be composed of numbers and alphanumeric characters 
and easily remembered names, phrases or notable words are the most convenient 
from the point of view of users of the system. 

Passwords are associated with the codewords of an error-correcting code and 
consequently any small number of errors of an entered password may be automati- 
cally corrected. Several additional parity symbols may be calculated by the system 
to extend the password length prior to hashing so as to overwhelm any attacks based 
on Rainbow tables. Dynamic mapping of code symbols is used to ensure a password 
when first registered by the user is a codeword of the error-correcting code. In this 
process sometimes a password, due to symbol contradictions, cannot be a codeword 
and an alternative word or phrase, which is a codeword, is offered to the user by the 
system. Alternatively, the user may elect to register a different password. 

Feedback can be provided to users by the system of the number of errors corrected 
for each user, re-entered password. Valid passwords are associated with a subset of 
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the totality of all the codewords of the error-correcting code and an entered password, 
may be confirmed to the user, as a valid password, or not. 

Confidential information, for example Personal Identification Numbers (PIN)s, 
bank account numbers, safe combinations, or more general confidential messages, are 
encrypted at source and stored as a sequence of encrypted messages. Each encrypted 
message is uniquely associated with a cryptographic hash of a valid codeword. 
Retrieval of the confidential information is achieved by the user entering a pass- 
word which is equal to the corresponding valid password or differs from a valid 
password in a small number of character positions. Any small number of errors are 
corrected automatically and feedback is provided to the user that a valid password 
has been decoded. The valid password is mapped to a single codeword from a very 
large number of codewords that comprise the error-correcting code. 

On receiving a valid hash, the cloud sends the stored encrypted message that 
corresponds to the valid codeword. The encryption key may be derived from the 
reconstituted password in conjunction of other user entered credentials, such as a 
fingerprint. The retrieved encrypted message is decrypted and the confidential infor- 
mation displayed to the user. 

Security is provided by the system at a number of different levels. Codewords of 
the error-correcting code are composed of a sequence of symbols with each symbol 
taken from a set of Galois Field (GF) elements. Any size of Galois Field may be 
used provided the number of GF elements is greater or equal to the alphabet of the 
language used to construct passwords. The mapping of alphabet characters to GF 
elements may be defined uniquely by each user and consequently there are at least 
q! possible mappings. 

The number of possible codewords of the error-correcting code is extremely large 
and typically there can be 10590 possible codewords. The number of valid codewords 
in the subset of codewords is typically less than 10? and so the brute force chance of a 
randomly selected codeword being a valid codeword is i oo . Even if an attacker, or an 
eavesdropper enters a valid codeword, the information that is obtained is encrypted 
and the confidential information cannot be retrieved without the encryption key, 
which requires the user’s credentials. 

One possible application of the system is as an information retrieval app on a 
smartphone with encrypted information stored in the cloud. For each registered user 
a cloud-based message server has stored a list of cryptographic hashes of valid 
codewords of the error-correcting code and an associated list of encrypted messages 
or files. The mapping of password characters to codeword GF symbols is carried out 
within the user’s smartphone and is not able to be easily accessed by an eavesdropper 
or an attacker unless the smartphone is stolen along with user login credentials. 
Additionally, the decryption of received encrypted messages is also carried out within 
the user's mobile phone. To access along, hard to remember PIN or a long sequence of 
cryptic characters, the user can enter the password, which is mapped to a GF symbol 
stream, which is automatically corrected by the smartphone before cryptographic 
hashing. The hash is encrypted, using a random session key exchanged using public 
key cryptography, before being transmitted by the smartphone to the cloud. This 
is to prevent replay attacks. If the codeword hash is correct, the cloud transmits 
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the corresponding encrypted message or file, together with an acknowledgement. 
The user's smartphone receives the cipher text and decrypts it into the requested 
information. 


18.2 Details of the Password System 


A block diagram of the system showing how user defined passwords are mapped to 
sequences of GF symbols, encoded into codewords of an error-correcting code and 
associated with encrypted confidential information is shown in Fig. 18.1. 

We consider as an example, a system using passwords consisting of sequences of 
up to 256 characters long with characters taken from the ANSI (American National 
Standards Institute) single byte character set and an error-correcting code which is 
a Reed-Solomon (RS) error-correcting code [2] described in Chaps. 7 and 11. RS 
codes are MDS codes, constructed from GF(q) field elements. For the finite field 
case, q is a prime or a power of a prime. In this example q — 2? and RS codewords 
are constructed as sequences of GF(256) symbols. Codewords can be designed to be 
any length up to q + 1 symbols long if the doubly extended version of the RS code 
is utilised. 

In general, any character set may be used in the system and any RS code may 
be used provided the sequence of characters is less than or equal to the length of 
the error-correcting code and each symbol of the error-correcting code is from an 
alphabet size equal or greater than the alphabet size of the character set used to define 
passwords. For maximum security, the mapping is chosen by a cryptographic random 
number generator, with a seed provided by the user so that there is a high probability 
that the resulting mapping table is unique to each user of the information retrieval 
system. 

Itis convenient to use a binary base field and the Galois Field [3], GF(256), that is 
used is an extension field consisting of 8 binary GF(2) field elements, generated by 
residues of a", n = 0 to 255 modulo 1 + x? + x? + x^ + x8, where 1 + x? + x? + 
х“ + x8 is an example of a primitive polynomial, plus the zero symbol G F (0). 

As an example, the registered password "silver" is considered, whose correspond- 
ing sequence of ANSI numbers is 


115 105 108 118 101 114 


As shown in Fig. 18.1, a mapping table is used to map these numbers to GF(256) 
symbols. In this example, the error-correcting code that is used is the (256, 254, 3) 
extended RS code which is capable of correcting either two erased symbols or one 
erroneous symbol, and the code has 254 information symbols and 2 parity-check 
symbols. The first two symbols are chosen as parity-check symbols and denoted 
as рі and p», respectively. Putting the parity symbols first is convenient because 
short codewords can easily by accommodated by assuming any unused information 
symbols have value zero and therefore do not affect the parity symbols. A general 
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codeword of this code as an extended GF(256) RS code is 


Рі P2 Хр X2 Хз X4 ... X254 


The general parity-check matrix of an extended RS code with n — k parity-check 
symbols is 


1 1 1 ЕТ 1 1 

1 o! o? o"! 0 

i 1 a? at а2ө-)) 0 
— 1 оз о® 0207-1) 0 


1 от 0120-6-10) от 10-1) 0 


To provide more flexibility in symbol mapping, as described below, the generalised 
extended RS code may be used with parity-check matrix Н,. 


no т 12 e Mn-1 Nn 
no то! та? LE 0 
H =| 7 то? тай 22. па 102 07D 0 
А no qa? паб 222 Mp0" YD 0 
no ga" ma? 0-*-D T nn- 107 710-0 0 
The constants 71, 72, 3, ... n, may be arbitrarily chosen provided they are non- 


zero symbols of GF(q). 

With two parity-check symbols, only the first two rows of H are needed and we 
may conveniently place the last column first to obtain the reduced echelon parity- 
check matrix H5 


Any pseudo random, one to one, mapping of ANSI numbers to GF(256) symbols 
may be used. It is convenient to map always the null character, ANSI number - 32, 
to the field element G F (0) otherwise each password would consist of 256 characters 
and 256 password characters would have to be entered for each password. With the 
null character mapping, a shortened RS codeword is equal to the full length codeword 
since any of ће G F(0) symbols may be deleted without affecting the parity-check 
symbols. Consequently, short passwords may be accommodated very easily. 

It is possible to choose a fixed one to one mapping of ANSI numbers to GF(256) 
symbols and make this equal for all users but in this case many passwords on first 
registering would fail as non-valid passwords, unless arbitrarily assigned characters 
are allowed in the parity symbol positions. However, this is an unnecessary con- 
straint on the system since codewords and passwords of different users are processed 
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independently from each other. Moreover, security is enhanced if each user uses a 
different mapping. 

In the following example, dynamic mapping is used and the mapping chosen is 
such that the information symbols of the RS codeword corresponding to "silver" are 
equal to a primitive root o raised to the power corresponding to the ANSI number of 
the character of the password in the same respective position as the codeword, except 
for the null character which is set to G F (0). As the codeword has parity symbols in 
the first two positions, and these symbols are a function of the other symbols in the 
codeword, (the information symbols), the mapping of the first two characters needs 
to be different. Accordingly, the codeword is 


pop ог198 o1 "uu а 0 ... 0 


From the parity-check matrix Нз, the parity-check symbols are given by 


254 


рә = So'x (18.1) 
1=1 
254 
р = > tm (18.2) 
j=l 


After substituting into Eq. (18.2) and then Eq. (18.1), it is found that p; = o??? and 
p2 = a?! and the complete RS codeword corresponding to the defined password 
"silver" is 


220 a? 108 а o0! a4 0 ... 0 


The RS codeword encoder is shown in Fig. 18.1 and uses the mapping of defined 
password characters to GF(256) symbols as input and outputs to the mapping table, 
as shown in Fig. 18.1, the mapping of the parity symbols. Accordingly, the mapping 
of the first two characters of the password is that ANSI number 115 is mapped to 
0220 and ANSI number 220 is mapped to œ!!5 and the mapping table is updated 
accordingly, as indicated in Fig. 18.1 by the two directional vectors. Of course in 
order for these mappings to be valid, neither ANSI number 115, nor ANSI number 
220, nor GF(256) symbols o/??9, nor a!!> must be already mapped otherwise the 
mapping of prior defined passwords will be affected. 

As new passwords are defined and new valid codewords calculated, it is rela- 
tively straightforward to amend the list of assigned and unassigned mappings of the 
mapping table in a dynamic manner. This dynamic mapping assignment is a feature 
in that it not only increases the range of possible passwords but has a secondary 
advantage. This secondary advantage arises from the mapping of entered passwords 
and the subsequent error-correction decoding. Any entered password character not 


18.2 Details of the Password System 457 


having an assigned ANSI number cannot be part of a valid password and accordingly 
the corresponding GF(256) symbol is marked as an erased symbol. Since on aver- 
age, twice as many erased characters can be corrected by an error-correcting code 
compared to the number of correctable erroneous characters, a distinct advantage 
arises. 
The confidential information corresponding to "silver" is, for example: 

“Тһе safe combination is 29 53 77 22" and as shown in Fig. 18.1 confidential infor- 
mation input to the system is encrypted using an encryption key. The encryption key 
is usually chosen from a master encryption key, unique to each user. Once input, the 
confidential information is only retained in encrypted form. The encrypted confiden- 
tial information associated with "silver" forms the encrypted text: 


AjelMHj q+iwé&nd* fh) y!"16£@h:G#) P7=3Mq|2=0+YX?z/+6sGs+2|Z1 
-GWp«)g/,HDZ)HA4D7F/j«*gFAqYlFCXZPMY6$3"/ 


As shown in Fig. 18.2, in order to retrieve this confidential information, the user 
re-enters their password. However, this entered password is allowed to contain errors. 
For example the password “solver” may be entered and has the corresponding ANSI 
number sequence: 


115 111 108 118 101 114 ... 32 32 2 


Following input of the password, as shown in Fig. 18.2, the mapping table is used 
to map the entered password into the GF(256) sequence 


220 а58 а/108 а "E a4 0... 0 


The decoder for the RS code, as shown in Fig. 18.2, decodes the sequence of GF(256) 
symbols, resulting from the mapping using the mapping table, into a codeword of 
the error-correcting code. In order to carry this out, two syndromes, s; and 52, are 
calculated from the two parity-check equations for the extended (256, 254, 3) RS 
code: 


254 
= Ух + Pot (18.3) 
1=1 
254 
dy = ox + po (18.4) 


The two syndromes, in this case, are found both to be equal to 0“ indicating there is 
an error in the second information symbol position of the codeword and this error is 
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o/?. If the same error had been in the third symbol position, say, the two syndromes 
would have been equal to o? and о“. 

Subtracting the error, 0“, from the entered symbol (after mapping) of a®* pro- 
duces the correct GF(256) symbol a>’. The codeword of the RS code is thus corrected 
to be 


а220 а а 198 118 а101 а“ 0... 0 


Applying the inverse mapping to each GF(256) symbol produces the ANSI number 
sequence 115 105 108 118 101 114 32 32 32 32...32 


115 105 108 118 101 114 32 32 32 32... 32 


This corresponds to "silver", the corrected entered password. 

As shown in Fig. 18.2, the decoded codeword is compared to the list of valid 
codewords of the error-correcting code. The codewords of the error-correcting code 
are split into two groups, the valid codewords and rest of the codewords, invalid 
codewords. The codeword 


o 229 g$ a128 118 q 0! qil4 0... 0 


is verified as a valid codeword associated with the encrypted confidential information: 


AjelMHj q+iwénd* fh) y!"16£@h:G#) P7=3Mq|2=0+YX?z/+6sGs+2 |Z1-GW 
p<) g/,HDZ) H4D7F/j+gFAGY1FCXZPMY6$3"/ 


As shown in Fig. 18.2, this is decrypted, using the encryption key and the confidential 
information is output: “The safe combination is 29 53 77 22” 

In a further extension of the system, as shown in Fig. 18.3, the encoded RS code- 
word, denoted as с, which results from the mapped, defined password is convolved 
with a fixed RS codeword denoted as 


Ух — а” -- ox + 2x? + а? x? + ЖЕР о??55 254 


Note that the standard polynomial-based RS codes of length q — 1 аге used in this 
system variation. The fixed RS codeword is the result of encoding a random set of 
GF(256) information symbols. The reason for doing this is to ensure that the resulting 
codeword after convolution, rx 


гу = c,.y modulo 1 + x? (18.5) 
does not have a long sequence of С F (0) symbols which may compromise the security 


of the information retrieval system. Correspondingly, it is the codeword r, which is 
associated with the encrypted message. As shown in Fig. 18.4, retrieval of encrypted 
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information is carried out by entering a password. After the decoding of the sequence 
of GF(256) symbols resulting from the mapping of the entered password, using 
the mapping table, into a codeword of the error-correcting code, this codeword is 
convolved with the fixed codeword as shown in Fig. 18.4. The resulting codeword is 
compared to the list of valid codewords of the error-correcting code. 

One feature, particularly with long passwords hard to remember, is that a partially 
known password may be entered, deliberately using characters known not to be 
contained in the mapping table, in order for the system to fill in the missing parts of 
the password. Characters may be reserved for this purpose. As a simple example, the 
password may be entered *si**er" where it is known that the character * will not be 
contained in the mapping table, because the character * had been previously defined 
as a reserved character. The corresponding codeword is 


0220 (88 erase, erase» a! а! 0... 0 


where erase; and erase» represent erased (unknown) GF(256) symbols. The decoder 
for the RS (256,254,3) error-correcting code may be used to solve straightforwardly 
for these erased symbols. The first step is to produce a reduced echelon parity-check 
matrix with zeros in the columns corresponding to the positions ofthe erased symbols, 
bar one. The procedure is described in detail in Chap. 11. 

For two erasures the procedure is trivial and the reduced echelon parity-check 
matrix H, is 


Н. = 1 1 1 1 ee 1 
* | a! d+a!) 0 (à? +a!) ... (а! +a!) 
Now, the erased symbol erase» may be solved directly using the second row of He 
02204! + 881 + о!) + eraser(a? + al) + a9 (оз +a!) +a! ^ (o? +a!) = 0 


and 


erase, — (o? aute + 88 +a% +a! + ql al +a = о1!8 


Using the first row of He, erase; сап now be solved 
а220 u88 tal! + erase ta ull =0 


and 


220 


erase; =a + a aw 


ЕА o9! m qil4 = 198 


With the reverse mapping the complete password is reconstituted allowing the 
encrypted information to be retrieved as before. 


(eseo рломввға рел) uoneuuogjur [erjuopguoo jo uondÁd1oop pue uonepi[eA рломәроэ “рломәроо рәху Jo uonrppe *proAssed рәләјиә jo Зшроәа psp “Sly 


вртомәроо 


(b)45 04 


o1eduroo 


18 Password Correction and Confidential ... 


IoydA190p uoryeurtopur рәҙаХтопә 


зпазпо 


WOTJRULIOFUT 510130120550 


462 


г, ѕрлотәроэ 
ш. 5) ome? 
поцаќлопә (О ә, Iq 
роли аеш 


paoassed 
jndut 


lopooop 
opoo SY 


рломәроо 


рәх 


18.2 Details of the Password System 463 


The advantage of defining erasures is that each unknown symbol may be solved 
for each parity symbol in the RS codeword. Having a relatively large number of parity 
symbols allows several parts of the entered password to be filled in automatically. 
Obviously security is compromised if this procedure is used to extreme. 


18.3 Summary 


This chapter has described the use of Reed-Solomon codes to correct user mistakes or 
missing parts of long entered passwords. The system is ideally suited to a smartphone- 
based encrypted, information retrieval system or a password-based authentication 
system. Dynamic, user-specific mapping of Galois field elements is used to ensure 
that passwords, arbitrarily chosen by the user, are valid codewords. A typical system is 
described based on GF(256) and the ANSI character set with worked examples given. 
Security is also enhanced by having, user-specific, Galois field symbol mapping 
because, with long passwords, this defeats Rainbow tables. 
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Chapter 19 
Variations оп the McEliece Public Key 
Cryptoystem 


19.1 Introduction and Background 


In 1978, the distinguished mathematician Robert McEliece invented a public key 
encryption system [8] based upon encoding the plaintext as codewords of an error- 
correcting code from the family of Goppa [6] codes. In this system, the ciphertext, 
sometimes termed the cryptogram, is formed by adding a randomly chosen error 
pattern containing up to f bits to each codeword. One or more such corrupted code- 
words make up the ciphertext. On reception, the associated private key is used to 
invoke an error-correcting decoder based upon the underlying Goppa code to correct 
the errored bits in each codeword, prior to retrieval of the plaintext from all of the 
information bits present in the decoded codewords. 

Since the original invention there have been a number of proposed improvements. 
For example, in US Patent 5054066, Riek and McFarland improved the security of 
the system by complementing the error patterns so as to increase the number of errors 
contained in the cryptogram [14] and cited other variations of the original system. 

This chapter is concerned with a detailed description of the original system plus 
some refinements which enhance the bandwidth efficiency and security of the original 
arrangement. The security strength of the system is discussed and analysed. 


19.1.1 Outline of Different Variations of the Encryption 
System 


In the originally proposed system [8] a codeword is generated from plaintext mes- 
sage bits by using a permuted, scrambled generator matrix of a Goppa code [6] of 
length п symbols, capable of correcting 1 errors. This matrix is the public key. The 
digital cryptogram is formed from codewords corrupted by exactly t randomly, or 
t pseudorandomly, chosen bit errors. The security is provided by the fact that it is 
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impossible to remove the unknown bit errors unless the original unpermuted Goppa 
code, the private key, is known in which case the errors can be removed by correcting 
them and then descrambling the information bits in the codeword to recover the orig- 
inal message. Any attempt to descramble the information bits without removing the 
errors first just results in a scrambled mess. In the original paper by McEliece [8], 
the Goppa codeword length п is 1024 and f is 50. The number of possible error 
combinations is 3.19 x 10% equivalent to a secret key of length 284 bits given a 
brute force attack. (There are more sophisticated attacks which reduce the equivalent 
secret key length and these are discussed later in this chapter.) 

In a variation of the original theme, after first partitioning the message into mes- 
sage vectors of length k bits each and encoding these message vectors into codewords, 
the codewords are corrupted by a combination of bit errors and bit deletions to form 
the cryptogram. The number of bit errors in each corrupted codeword is not fixed, 
but is an integer s, which is randomly chosen, with the constraint that, s < 1. This 
increases the number of possible error combinations, thereby increasing the security 
of the system. As a consequence 2(t — s) bits may be deleted from each codeword 
in random positions adding to the security of the cryptogram as well as reducing its 
size, without shortening the message. In the case of the original example, above, with 
5 < s < t the number of possible error combinations is increased to 3.36 x 1085 and 
the average codeword in the cryptogram is reduced to 999 bits from 1024 bits. 

Most encryption systems are deterministic in which there is a one-to-one cor- 
respondence between the message and the cryptogram with no random variations. 
Security can be improved through the use of a truly, random integer generator, not 
a pseudorandom generator to form the cryptogram. Consequently, the cryptogram 
is not predictable or deterministic. Even with the same message and public key, the 
cryptogram produced will be different each time and without knowledge of the ran- 
dom errors and bit deletions, which may be determined only by using the structure 
of the Goppa code, recovery of the original message is practically impossible. 

The basic McEliece encryption system has little resistance to chosen-plaintext 
(message) attacks. For example, if the same message is encrypted twice and the two 
cryptograms are added modulo 2, the codeword of the permuted Goppa code cancels 
out and the result is the sum of the two error patterns. Clearly the encryption method 
does not provide indistinguishability under chosen-plaintext attack (IND-CPA), a 
quality measure used by the cryptographic community. 

However, an additional technique may be used which does provide (IND-CPA) 
and results in semantically secure cryptograms. The technique is to scramble the 
message twice by using a second scrambler. With scrambling the message using the 
fixed non-singular matrix contained in the public key as well, a different scrambler is 
used to scramble each message in addition. The scrambling function of this second 
scrambler is derived from the random error vector which is added to the codeword 
to produce the corrupted codeword after encoding using the permuted, scrambled 
generator matrix of a Goppa code. As the constructed digital cryptogram is a function 
of truly randomly chosen vectors, not pseudorandomly chosen vectors, or a fixed 
vector, the security of this public key encryption system is enhanced compared to 
the standard system. Even with an identical message and using exactly the same 
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public key, the resulting cryptograms will have no similarity at all to any previously 
generated cryptograms. This is not true for the standard McEliece public key system 
as each codeword will only differ in a maximum of 2f bit positions. Providing this 
semantic security eliminates the risk from known plaintext attacks and is useful in 
several applications such as in RFID, and these are discussed later in the chapter. 

An alternative to using a second scrambler is to use a cryptographic hash function 
such as SHA-256 [11] or SHA-3 [12] to calculate the hash of each f bit error pattern 
and add, modulo 2, the first k bits of the hash values to the message prior to encoding. 
Effectively the message is encrypted with a stream cipher prior to encoding. 

Having provided additional message scrambling, it now becomes safe to represent 
the generator matrix in reduced echelon form, i.e. a k x k identity matrix followed 
by a (n — k) x k matrix for the parity bits. Consequently, the public key may be 
reduced in size from a n x k matrix to a (n — k) x k matrix corresponding typically 
to a reduction in size of around 65%. This is useful because one of the criticisms of 
the McEliece system is the relatively large size of the public keys. 

Most attacks on the McEliece system are blind attacks and rely on the assump- 
tion that there are exactly t errors in each corrupted codeword. If there are more 
than f errors these attacks fail. Consequently, to enhance the security of the system, 
additional errors known only to intended recipients may be inserted into the digital 
cryptogram so that each corrupted codeword contains more than f errors. A sophis- 
ticated method of introducing the additional errors is not necessary since provided 
there are sufficient additional errors to defeat decryption based on guessing the posi- 
tions of the additional errors the message is theoretically unrecoverable from the 
corrupted digital cryptogram even with knowledge of the private key. This feature 
may find applications where a message needs to be distributed to several recipients 
using the same or different public/private keys at the same time, possibly in a com- 
mercial, competitive environment. The corrupted digital cryptograms may be sent 
to each recipient arriving asynchronously, due to variable network delays and only 
a relatively short secret key containing information of the additional error positions 
needs to be sent at the same time to all recipients. 

In another arrangement designed to enhance the security of the system, additional 
errors are inserted into each codeword in positions defined by a position vector, 
which is derived from a cryptographic hash of the previous message vector. Standard 
hash functions may be used such as SHA-256 [11] or SHA-3 [12]. The first message 
vector can use a position vector derived from a hash or message already known by 
the recipient of the cryptogram. 

These arrangements may be used in a wide number of different applications 
such as active and passive RFID, secure barcodes, secure ticketing, magnetic cards, 
message services, email applications, digital broadcasting, digital communications, 
video communications and digital storage. Encryption and decryption is amenable 
to high speed implementation operating at speeds beyond 1 Gbit/s. 
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19.2 Details of the Encryption System 


The security strength of the McEliece public key encryption system stems from the 
fact that a truly random binary error pattern is added to the encoded message as part 
of the digital cryptogram. Even with the same message and the same public key a 
different digital cryptogram is produced each time. Each message is encoded with 
a scrambled, binary mapped, permuted, version of a GF(2") Goppa code. Without 
the knowledge of the particular Goppa code that is used, the error pattern cannot be 
corrected and the message cannot be recovered. It is not possible to deduce which 
particular Goppa code is being used from the public key, which is the matrix used 
for encoding, because this matrix is a scrambled, permuted version of the original 
encoding matrix of the Goppa code, plus the fact that for a given m there are an 
extremely large number of Goppa codes [8]. 

The message information to be sent, if not in digital form, is digitally encoded into 
binary form comprising a sequence of information bits. The method of encryption 
is shown in Fig. 19.1. The message comprising a sequence of information bits is 
formatted by appending dummy bits as necessary into an integral number m of binary 
message vectors of length k bits each. This is carried out by format into message 
vectors shown in Fig. 19.1. Each message vector is scrambled and encoded into a 
codeword, n bits long, defined by an error-correcting code which is derived from 
a binary Goppa code and a scrambling matrix. The binary Goppa code is derived 
from a non-binary Goppa code and the procedure is described below for a specific 
example. 

The encode using public key shown in Fig. 19.1 carries out the scrambling and 
codeword encoding for each message vector by selecting rows of the codeword 
generator matrix according to the message bits contained in the message vector. This 
operation is described in more detail below for a specific example. The codeword 
generator matrix to be used for encoding is defined by the public key which is stored 
in a buffer memory, public key shown in Fig. 19.1. As shown in Fig. 19.1, a random 
number generator generates a number s internally constrained to be less than or equal 
to t and this is carried out by generate number of random errors (s). The parameter 
t is the number of bit errors that the Goppa code can correct. 


encode 
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E bits cryptogram 


using 
ч message vectors (2 
message іпрш € public key 


generate position vector 
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Fig. 19.1 Public key encryption system with s random bit errors апа 2(/- s) bit deletions 
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Fig. 19.2 Random integer generator of the number of added, random bit errors, s 


The number of random errors s is input to generate random errors which for each 
codeword, initialises an n bit buffer memory with zeros, and uses a random number 
generator to generate s 1’s in s random positions of the buffer memory. The contents 
of the n bit buffer are added to the codeword of n bits by add shown in Fig. 19.1. 
The 1° are added modulo 2 which inverts the codeword bits in these positions so 
that these bits are in error. In Fig. 19.1, t — s erasures takes the input s, calculates 
2(t — s) and outputs this value to position vector which comprises a buffer memory of 
n bits containing a sequence of integers corresponding to a position vector described 
below. The first 2(t — s) integers are input to delete bits which deletes the bits in 
the corresponding positions of the codeword so that 2(t — s) bits of the codeword 
are deleted. The procedure is carried out for each codeword so that each codeword 
is randomly shortened due to deleted bits and corrupted with a random number of 
bit errors in random positions. In Fig. 19.1, format cryptogram has the sequence of 
shortened corrupted codewords as input and appends these together, together with 
formatting information to produce the cryptogram. 

The highest level of security is provided when the block generate number of 
random errors (s) of Fig. 19.1 is replaced by a truly random number generator and 
not a pseudorandom generator. An example of a random number generator is shown 
in Fig. 19.2. 

The differential amplifier with high gain amplifies the thermal noise generated by 
the resistor terminated inputs. The output of the amplifier is the amplified random 
noise which is input to a comparator which carries out binary quantisation. The 
comparator output is 1 if the amplifier output is a positive voltage апа 0 otherwise. 
This produces 175 and 0’s with equal probability at the output of the comparator. 
The output of the comparator is clocked into a shift register having p shift register 
stages, each of delay Т. The clock rate is 1. After p clock cycles, the contents of the 
shift register represent a number in binary which is the random number s having a 
uniform probability distribution between 0 and 2? — 1. 

One or more of the bits output from the shift register may be permanently set to 
1 to provide a lower limit to the random number of errors s. As an example, if the 
4% bit (counting from the least significant bits) is permanently set to 1 then s has а 
uniform probability distribution between 2? — 8 and 2? — 1. 

Similarly, the highest level of security is provided if the positions of the errors 
generated by generate random errors of Fig. 19.1 is a truly random number generator 
and not a pseudorandom generator. Ап example of an arrangement which generates 
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Fig. 19.3 Random integer generator of error positions 


truly random positions in the range of 0 to 2" — 1 corresponding to the codeword 
length is shown in Fig. 19.3. 

As shown in Fig. 19.3, the differential amplifier, with high gain amplifies the 
thermal noise generated by the resistor terminated inputs. The output of the amplifier 
is the amplified random noise which is input to a comparator which outputs a 1 if the 
amplifier output is a positive voltage and a 0 otherwise. This produces 175 and O's 
with equal probability at the output of the comparator. The output of the comparator 
is clocked into a flip-flop clocked at 4, with the same clock source as the shift register 
shown in Fig. 19.3, shift register. The output of the flip-flop is a clocked output of truly 
random 175 and 0’s which is input to a nonlinear feedback shift register arrangement. 

The output of the flip-flop is input to a modulo 2, adder add which is added to 
the outputs of a nonlinear mapping of u selected outputs of the shift register. Which 
outputs are to be selected correspond to the key which is being used. The parameter 
u is a design parameter, typically equal to 8. 

The nonlinear mapping nonlinear mapping shown in Fig. 19.3 has a pseudoran- 
dom one-to-one correspondence between each of the 2” input states to each of the 2” 
output states. An example of such a one to one correspondence, for и = 4 is given 
in Table 19.1. For example, the first entry, 0000, value 0 is mapped to 0011, value 3. 

The shift register typically has a relatively large number of stages, 64 is a typical 
number of stages and a number of tapped outputs, typically 8. The relationship 
between the input of the shift register а;, and the tapped outputs is usually represented 
by the delay operator D. Defining the tap positions as w;, for i = 0 to imax, the input 
to the nonlinear mapping nonlinear mapping shown in Fig. 19.3, defined as x; for 
i = 0 (0 imax, 18 

Xj = ai, D (19.1) 


and the output y; after the mapping function, depicted as M is 
yj = М[х] = M[ai,D"'] (19.2) 


The input to the shift register is the output of the adder given by the sum of the 
random input R,„a and the summed output of the mapped outputs. Accordingly, 
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Table 19.1 Example of 
nonlinear mapping for u — 4 


0000 — 0011 
0001 — 1011 
0010 — 0111 
0011 — 0110 
0100 — 1111 
0101 — 0001 
0110 — 1001 
0111 — 1100 
1000 — 1010 
1001 — 0000 
1010 — 1000 
1011 — 0010 
1100 — 0101 
1101 — 1110 
1110 — 0100 
1111 — 1101 


Imax Imax Imax 


Gin = Ry + Уу = Rma + Š Mi = Rma + У` м[а0"] (19.3) 
j=0 j=0 j=0 


It can be seen that the shift register input aj, is a nonlinear function of delayed outputs 
of itself added to the random input К, and so will be a random binary function. 

The positions of the errors are given by the output of m-bit input shown in Fig. 19.3, 
an m bit memory register and defined as epos. Consider that the first m outputs of 
the shift register are used as the input to m-bit input. The output of m-bit input is a 
binary representation of a number given by 


m-—1 
epos 0 жал (19.4) 
і-0 


Since а, is a random binary function, epos will be an integer between 0 and 
2" — 1 randomly distributed with a uniform distribution. As shown in Fig. 19.3, 
these randomly generated integers are stored in memory in error positions buffer 
memory after eliminate repeats has eliminated any repeated numbers, since repeated 
integers will occur from time to time in any independently distributed random integer 
generator. 

The random bit errors and bit deletions can only be corrected with the knowledge 
of the particular non-binary Goppa code, the private key, which is used in deriv- 
ing the codeword generator matrix. Reviewing the background on Goppa codes: 
Goppa defined a family of codes [6] where the coordinates of each codeword 
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(co. C1, C2, ... Сәт} with {co = xo, €1 = X1, C2 = Х2,...С9»-1 = Xon.) Satisfy 
the congruence p(z) modulo g(z) — 0 where g(z) is now known as the Goppa poly- 
nomial and p(z) is the Lagrange interpolation polynomial. 

Goppa codes have coefficients from GF (2") and provided g (2) has no roots which 
are elements of GF (2") (which is straightforward to achieve) the Goppa codes have 
parameters (2”, К, 2" — k + 1). Goppa codes can be converted into binary codes. 
Provided that g(z) has no roots which are elements of GF(2”) and has no repeated 
roots, the binary code parameters аге (2", 2" — mt, dmin) where 4,, > 2t + 1, the 
Goppa code bound on minimum Hamming distance. Most binary Goppa codes have 
equality for the bound and ¢ is the number of correctable errors. 

For a Goppa polynomial of degree r, there are r parity check equations defined 
from the congruence. Denoting 2(2) by 


gZ) = g,z gaz + gozo gizd go (19.5) 
2m..] с 
>) —— =0 modulo в (2) (19.6) 
0 © i 


Since Eq. (19.6) is modulo g(z) then g(z) is equivalent to 0, and we can add g(z) to 
the numerator. Dividing each term z — о; into 1 + g(z) produces the following 


(z) +1 r4 +1 
EX = + 


£z — Qj £z — Qi 


(19.7) 


where г„ is the remainder, an element of GF(2”) after dividing g(z) by z — oj. 
AS Fm is a scalar, g(z) may simply be pre-multiplied by l so that the remainder 
cancels with the other numerator term which is 1. 


Srl qo Rt! ао 


29 (19.8) 
2-- 04 Vm 2-- 04 Ғт 
As 
g(z) = (z — aj)qi(z) + ғ (19.9) 
When z = Qi, ғ, = g(oj). 
Substituting for ғ, in Eq. (19.8) produces 
g) 
ml 1 ; 
С шы (19.10) 
2—0; g(a) 
Since i2 modulo g(z) — 0 
1 i 
- 40 (19.11) 


2-0; g(a) 
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The quotient polynomial q;(z) is a polynomial of degree r — 1 with coefficients which 
are a function of о; and ће Goppa polynomial coefficients. Denoting q;(z) as 


4:00) = dio + diaz + Gia’ + diaz) +--+ diez d (19.12) 


Since the coefficients of each power of z sum to zero the r parity check equations 
are given by 
2n—1 
Cidij _ es 
> =0 for ј=0 to r—1 (19.13) 
2-4 g(ou) 


If the Goppa polynomial has any roots which are elements of GF (2"), say оу, then 
the codeword coordinate c; has to be permanently set to zero in order to satisfy 
the parity check equations. Effectively the codelength is shortened by the number 
of roots of g(z) which are elements of GF(2"). Usually the Goppa polynomial is 
chosen to have distinct roots which are not in GF(2”). 

The security depends upon the number of bit errors added and in practical exam- 
ples to provide sufficient security, it is necessary to use long Goppa codes of length 
2048 bits, 4096 bits or longer. For brevity, the procedure will be described using an 
example of a binary Goppa code of length 32 bits capable of correcting 4 bit errors. It 
is important to note that all binary Goppa codes are derived from non-binary Goppa 
codes which are designed first. 

Inthis example, the non-binary Goppa code consists of 32 symbols from the Galois 
field GF(25) and each symbol takes on 32 possible values with the code capable of 
correcting two errors. There are 28 information symbols and 4 parity check symbols. 
(It should be noted that when the Goppa code is used with information symbols 
restricted to binary values as in a binary Goppa code, twice as many errors can 
be corrected). The non-binary Goppa code has parameters of a (32, 28, 5) code. 
There are 4 parity check symbols defined by the 4 parity check equations and the 
Goppa polynomial has degree 4. Choosing arbitrarily as the Goppa polynomial, the 
polynomial 1 + z+ z^ which has roots only in GF(16) and none in GF(32), we 
determine q;(z) by dividing by z — о;. 


qiz) = 2 + оц? t oz (0) + о) (19.14) 


The 4 parity check equations are 


31 g 
Бы за) (19.15) 
5 g(a) 
31 
16104) 
>, =0 (19.16) 
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31 2 
Cia; 
> ro (19.17) 
і-0 t 
31 3 
ci(1 + 07) 
о Ewi 


Using ће GF(2>) Table 19.2 to evaluate the different terms for GF (25), the parity 
check matrix is 


1 1 ee aL a... a! 
0 1 a? PEU а23 a? . a 

Haz, 28, 5) = 0 1 alba! aa? a (19.19) 
1 0 a? a” a’ a!’ ...a 


To implement the Goppa code as a binary code, the symbols in the parity check 
matrix are replaced with their m-bit binary column representations of each respective 
GF (2") symbol. For the (32, 28, 5) Goppa code above, each of the 4 parity symbols 
will be represented as a 5-bit symbol from Table 19.2. The parity check matrix will 
now have 20 rows for the binary code. The minimum Hamming distance of the binary 
Goppa code is improved from r + 1 to 2r + 1. Correspondingly, the example binary 
Goppa code becomes a (32, 12, 9) code with parity check matrix: 


111001... 
000100... 
001110... 
001011... 
001101... 
011011... 
001110... 
001010... 
001011... 

Наа = 011110. 
001010... 
000011... 
001000... 
001010... 
100011... 
001101... 
001110... 
001100... 
000101... 


(19.20) 


Q Qo QC E E C Egg CK СО CO Oo SO н 


19.2 Details of the Encryption System 475 


Table 19.2 GF(32) non-zero 0 


extension field elements ii 1 =] 

defined by 1 + o? +a° = 0 jp Eu 
a^ = а 
PENAS 
o^ = а 
в? = 1 +02 
об = а +о? 
o! = оа? + о 
o5 = 1 +02 + o? 
а = оа +a? + ай 
all = 1 +0“ 
al! = 1+0 +a? 
ol? =a +a? +a? 
ol? =a? +a? + at 
alt =1 +a? +a? +at 
ol? =1+a +a? +a? +at 
016 =1 +a +a? +at 
a1 =1+a+at 
ol$ =1+a 
ol? =a + о? 
o2 = a? + a? 
oai mg bg 
a2 au 2 dt 
оЗ-1-о--о2--оЗ 
a? Sao? o) o 
аза qa 
o?? =1+a+a2+at 
o?! =1+о + о? 
a? афо o 
a qui 
o? =a Ьо“ 


The next step is to turn the parity check matrix into reduced echelon form by using 
elementary matrix row and column operations so that there are 20 rows representing 
20 independent parity check equations for each parity bit. From the reduced echelon 
parity check matrix, the generator matrix can be obtained straightforwardly as it is 
the transpose of the reduced echelon parity check matrix. The resulting generator 
matrix is: 


476 


С(з2,12,9) = | 
| 


ooooooocooqooor 
оооооооооо но 
qoooocoococrceo 
OOO: O- 6: 0o0O0-o0oo 
cooocooocoroococo 
cooocoooroocooco 
oooococoroceoecoo 
ooooroocococo 
ooorooococjoco 
әоеооооооссо 
ә-ээоооосососоос 
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011000111101001 
011010110000110 
000110011000011 
011111101010110 
011000011010011 
011111001100010 
000001011111100 
000111001100111 
011110111111101 
011101101111001 
000011100111011 
111101100100110 


—oo-o-ooo-o- 
ъз ка > зз. ка. a СЫ ма о 
лңмаео---ошооосе-е- 


-оеооосоосомесок 
= © — — оо kK OCC SO 


—oo—-oo—-—-oo-c- 


(19.21) 


It will be noticed that the generator matrix is in reduced echelon form and has 12 
rows, one row for each information bit. Each row is the codeword resulting from that 


information bit equal to a 1, all other information bits equal to 0. 


The next step is to scramble the information bits by multiplying by a k x k non- 
singular matrix, that is one that is invertible. As a simple example, the following 


12 x 12 matrix is invertible. 


№; = 


011101001110 
001110100111 
100111010011 
110011101001 
111001110100 
011100111010 
001110011101 
100111001110 
010011100111 
101001110011 
110100111001 
111010011100 


The above is invertible using the following matrix: 


—1 A. 
NS 32x12 7 


110100000000 
011010000000 
001101000000 
000110100000 
000011010000 
000001101000 
000000110100 
000000011010 
000000001101 
100000000110 
010000000011 
101000000001 


(19.22) 


(19.23) 
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The next step is to scramble the generator matrix with the non-singular matrix to pro- 
duce the scrambled generator matrix given below. The code produced with this gen- 
erator matrix has the same codewords as the generator matrix given by matrix (19.21) 
and can correct the same number of errors but there is a different mapping to code- 
words from a given information bit pattern. 


011101001110111001011 0000001117] 
001110100111000110011 000110101 
0011101001111001001110100001011 
0011101001001110111 001000100 
1001110100000001100 010010010 
011100 1010110000111 00011 01 

8632129 7|60111001110111000000110101011100 (19.24) 
001110011100000011011000100 10 
01001110011111111010101111001000 
01001110011110011011 00000 10 
0100 001110001011 001000010 
| 10100 10011000000101010111011] 


It may be seen that, for example, the first row of this matrix is the modulo 2 sum of 
rows 1, 2, 3, 5, 8, 9 and 10 of matrix (19.21) in accordance with the non-singular 
matrix (19.22). 

The final step in producing the public key generator matrix for the codewords from 
the message vectors is to permute the columns of the matrix above. Any permutation 
may be randomly chosen. For example we may use the following permutation: 


N 
N 
m 
ызы 
ш N 


921171471620 1 29 8 111225 5 3024 6 1813 3 0 2623282231 9 10 (19.25) 
45 6 789 1011 12 13 I4 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 А 


so that for example column 0 of matrix (19.24) becomes column 24 of the per- 
muted generator matrix and column 31 of matrix (19.24) becomes column 29 of the 
permuted generator matrix. The resulting, permuted generator matrix is given below. 


000111110011110101100011000011117 
11111000011010100000100101001111 
00101100111000110110001110110101 
01101101011111101100110010001000 
10010110100100000111110010001010 
10011100101111010000111101011101 

95632129 = | 19110100101011111000001100110010 (19.26) 
00100110001011001110010110010011 
01100001011100111101111000111011 
00011110111010110110101010011001 
00001110101101111010101110001000 
10110000101101010011001011011110 


With this particular example of the Goppa code, the message needs to be split into 

message vectors of length 12 bits, adding padding bits as necessary so that there is 
an integral number of message vectors. As a simple example of a plaintext message, 
consider that the message consists of a single message vector with the information 
bit pattern: 
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10, 1,0, 1, 1, 1,0,0,0,0,0, 1} 


Starting with an all 0’s vector, where the information bit pattern is 1, the correspond- 
ing row from the permuted, scrambled matrix, matrix (19.26) with the same position 
is added modulo 2 to the result so far to produce the codeword which will form the 
digital cryptogram plus added random errors. In this example, this codeword is gen- 
erated from adding modulo 2, rows 2, 4, 5, 6 and 12 from the permuted, scrambled 
matrix, matrix (19.26) to produce: 


0001 1 00 1 1010 1000 100001 1 
00 0 I1 001 000 0 1000 1 0 1 0 0 
01101 0 0 1 1 1101 0011001000100 
(19.27) 
0010 10100100000 111100 0001010 
011000010 10101001100 0110 1 10 
тте og WoW Db JE 3b 3C dE dT HR M4 dp dp dI dp 3Wo db (E dB dH WO po d o 
0 1 1 00010000101 00000 001 00 10 


The resulting codeword is: 
{01111000100001011000001001100110} 


This Goppa code can correct up to 4 errors, (t = 4), so a random number is chosen 
for the number of bits to be in error (s) and 2(t — s) bits are deleted from the codeword 
in pre-determined positions. The pre-determined positions may be given by a secret 
key, a position vector, known only to the originator and intended recipient of the 
cryptogram. It may be included as part of the public key, or may be contained in a 
previous cryptogram sent to the recipient. An example of a position vector, which 
defines the bit positions to be deleted is: 


(19, 3, 27, 17, 8, 30, 11, 15, 2, 5, 19, ..., 25). 


The notation being, for example, that if there are 2 bits to be deleted, the bit positions 
to be deleted are the first 2 bit positions in the position vector, 19 and 3. As well as 
the secret key, the position vector, the recipient needs to know the number of bits 
deleted, preferably with the information provided in a secure way. One method is 
for the message vector to contain, as part of the message, a number indicating the 
number of errors to be deleted in the next codeword, the following codeword (not 
the current codeword); the first codeword having a known, fixed number of deleted 
bits. 

The number of bit errors and the bit error positions are randomly chosen to be 
in error. A truly random source such as a thermal noise source as described above 
produces the most secure results, but a pseudorandom generator can be used instead, 
particularly, if seeded from the time of day with a fine time resolution such as 1 ms. If 
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the number of random errors chosen is too few, the security of the digital cryptogram 
will be compromised. Correspondingly, the minimum number of errors chosen is a 
design parameter depending upon the length of the Goppa code and 1, the number 
of correctable errors. A suitable choice for the minimum number of errors chosen in 
practice lies between 5 and A. 

For the example above, consider that the number of bit errors is 2 and these are 
randomly chosen to be in positions 7 and 23 (starting the position index from 0). The 
bits in these positions in the codeword are inverted to produce the result: 


{01111001100001011000001101100110}. 


As there are 2 bits in error, 4 bits (2(t — s) = 2(4 — 2)) may be deleted. Using the 
position vector example above, the deleted bits are in positions (19, 3, 27 and 17] 
resulting in 28 bits, 


{0111001100001011000110110110}. 


This vector forms the digital cryptogram which is transmitted or stored depending 
upon the application. 

The intended recipient of this cryptogram retrieves the message in a series of steps. 
Figure 19.4 shows the decryption system. The retrieved cryptogram is formatted into 
corrupted codewords by format into corrupted codewords shown in Fig. 19.4. In the 
formatting process, the number of deleted bits in each codeword is determined from 
the retrieved length of each codeword. The next step is to insert 0’s in the deleted bit 
positions so that each corrupted codeword is of the correct length. This is carried out 
using fill erased positions with 07% as input, the position vector stored in a buffer mem- 
ory as position vector in Fig. 19.4 and the number of deleted (erased) bits from for- 
mat into corrupted codewords. For the example above, the recipient first receives or 
otherwise retrieves the cryptogram {0111001100001011000110110110}. 
Knowing the number of deleted bits and their positions, the recipient inserts 0’s in 
positions (19, 3, 27 and 17) to produce: 


{01101001100001011000001101100110}n 


fill erased b permute errors and erasures 
positions wit bits correction 
s 


format into 
corrupted codewords 


cryptogram 
inpu 


НЕ descramble 
position private сесара. format 
vector victis message 


Fig. 19.4 Private key decryption system with s random bit errors and 2(t — s) bit deletions 
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The private key contains the information of which Goppa code was used, the 
inverse of the non-singular matrix used to scramble the data and the permutation 
applied to codeword symbols in constructing the public key generator matrix. This 
information is stored in private key in Fig. 19.4. 

For the example, the private key is used to undo the permutation applied to code- 
word symbols by applying the following permutation: 


01234 5 6 789 1011 12 13 14 I5 16 17 18 19 20 21 22 23 24 25 26 27 28 29 3031 (19.28) 
27 154219 21 17 147 1620 1 29 8 11 1225 5 3024 6 1813 3 0 2623282231 9 10 ` 


so that, for example, bit 24 becomes bit 0 after permutation and bit 27 becomes bit 
31 after permutation. The resulting, corrupted codeword is: 


{00011001110011110001000101100001} 


The permutation is carried out by permute bits shown in Fig. 19.4. 

The next step is to treat the bits in the corrupted codeword as GF (2?) symbols and 
use the parity check matrix, matrix (19.19), from the private key to calculate the syn- 
drome value for each row of the parity check matrix to produce 028, o7, a!3, апда 19. 
This is carried out by an errors and erasures decoder as a first step in correcting the 
errors and erasures. The errors and erasures are corrected by errors and erasures 
correction, which knows the positions of the erased bits from fill erased positions 
with 07 shown in Fig. 19.4. 

In the example, the errors and erasures are corrected using the syndrome values 
to produce the uncorrupted codeword. There are several published algorithms for 
errors and erasures decoding [1, 13, 16]. Using, for example, the method described 
by Sugiyama [16], the uncorrupted codeword is obtained: 


{10001001110000100111011001100101} 
The scrambled information data is the first 12 bits of this codeword: 
{100010011100} 


The last step is to unscramble the scrambled data using matrix (19.23) to produce 
the original message after formatting the unscrambled data: 


(0, 1, 0, 1, 1, 1, 0, 0, 0, 0, 0, 1} 
In Fig. 19.4, descramble message vectors take as input the matrix which is the inverse 


of the non-singular matrix stored in private key and output the descramble message 
vectors to format message. 
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In practice, much longer codes of length п would be used than described above. 
Typically n is set equal to 1024, 2048, 4096 bits or longer. Longer codes are more 
secure but the public key is larger and encryption and decryption take longer time. 

Consider an example with n = 1024, correcting t = 60 bit errors with a randomly 
chosen irreducible Goppa polynomial of degree 60, say, g(z) -1--2--22--22--:9. 

Setting the number of inserted bit errors s as a randomly chosen number from 40 
to 60, the number of deleted bits correspondingly, is 2(t — в), ranging from 40 to 0 
and the average codeword length is 994 bits. There аге 9.12 х 10°% different bit error 
combinations providing security, against naive brute force decoding, equivalent to a 
random key of length 325 bits. The message vector length is 424 bits per codeword of 
which 6 bits may be assigned to indicate the number of deleted bits in the following 
codeword. It should be noted that there are more effective attacks than brute force 
decoding as discussed in Sect. 19.5. 

As another example with n = 2048 and correcting t = 80 bit errors with a 
randomly chosen irreducible Goppa polynomial of degree 80, an example being 
giz) =l +z Hz" Hz. 

Setting the number of inserted bit errors s as a randomly chosen number from 40 
to 80, the number of deleted bits correspondingly, is 2(t — s), ranging from 80 to 0 and 
the average codeword length is 2008 bits. There are 2.45 х 10144 different bit error 
combinations providing security, against naive brute force decoding, equivalent to a 
random key of length 482 bits. The message vector length is 1168 bits per codeword 
of which 7 bits may be assigned to indicate the number of deleted bits in the following 
codeword. 

In a hybrid arrangement where the sender and recipient share secret information, 
additional bits in error may be deliberately added to the cryptogram using a secret 
key, the position vector to determine the positions of the additional error bits. The 
number of additional bits in error is randomly chosen between 0 and n — 1. The 
recipient needs to know the number of additional bits in error (as well as the position 
vector), preferably with this information provided in a secure way. One method is for 
the message vector to contain, as part of the message, the number of additional bits in 
error in the next codeword that is the following codeword (not the current codeword). 
It is arranged that the first codeword has a known, fixed number of additional bits in 
error. 

As each corrupted codeword contains more than ¢ bits in error, it is theoreti- 
cally impossible, even with the knowledge of the private key to recover the original 
codewords free from errors and to determine the unknown bits in the deleted bit posi- 
tions. It should be noted that this arrangement defeats attacks based on information 
set decoding, which is discussed later. The system is depicted in Fig. 19.5. 

This encryption arrangement is as shown in Fig. 19.1 except that the system 
accommodates additional errors added by generate additional errors shown in 
Fig. 19.5 using a random integer generator between 0 and n — 1 generated by generate 
random number of additional errors. Any suitable random integer generator may be 
used. For example, the random integer generator design shown in Fig. 19.2 may be 
used with the number of shift register stages p now set equal to m, where n — 2". 
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Fig. 19.5 Public key encryption system with s random bit errors, 2(t — s) bit deletions and a random 
number of additional errors 


Additional errors may be added in the same positions as random errors, as this 
provides for a simpler implementation or may take account of the positions of the 
random errors. However, there is no point in adding additional bit errors to bits which 
will be subsequently deleted. 

As shown in Fig. 19.5, the number of additional errors is communicated to the 
recipient as part of the message vector in the preceding codeword with the information 
included with the message. This is carried out by format into message vectors shown 
in Fig. 19.5. In this case, usually 1 or 2 more message vectors in total will be required 
to convey the information regarding numbers of additional errors and the position 
vector (if this has not been already communicated to the recipient). Clearly, there 
are alternative arrangements to communicate the numbers of additional errors to the 
recipient such as using a previously agreed sequence of numbers or substituting a 
pseudorandom number generator for the truly random number generator (generate 
random number of additional errors shown in Fig. 19.5) with a known seed. 

Using the previous example above, with the position vector: 


(19, 3, 27, 17, 8, 30, 11, 15, 2, 5, 19, ..., 25} 


The errored bits are in positions 7 and 23 (starting the position index from 0) and 
the deleted bits are in positions {19, 3, 27 and 17}. The encoded codeword prior to 
corruption is: 


{01111000100001011000001001100110} 


The number of additional bits in error is randomly chosen to be 5, say. As the first 4 
positions (index 0-3) in the position vector are to be deleted bits, starting from index 
4, the bits in codeword positions (8, 30, 11, 15, and 2} are inverted in addition to 
the errored bits in positions 7 and 23. The 32 bit corrupted codeword is produced: 
{01011001000101001000001101100100}. 
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The bits in positions (19, 3, 27 and 17] are deleted to produce the 28 bit corrupted 
codeword: 


{0101001000101001000110110100} 


The additional bits in error are removed by the recipient of the cryptogram prior to 
errors and erasures correction as shown in Fig. 19.6. The number of additional bits in 
error in the following codewords is retrieved from the descrambled message vectors 
by format message shown in Fig. 19.6 and input to number of additional errors which 
outputs this number to generate additional errors which is the same as in Fig. 19.5. 
The position vector is stored in a buffer memory in position vector and outputs this to 
generate additional errors. Each additional error is corrected by the adder add, shown 
in Fig. 19.6, which adds, modulo 2, a 1 which is output from generate additional 
errors in the same position of each additional error. Retrieval of the message from 
this point follows correction of the errors and erasures, descrambling and formatting 
as described for Fig. 19.5. 

Using the number of deleted bits and the position vector, 0’s are inserted in the 
deleted bit positions to form the 32 bit corrupted codeword: 


{01001001000101001000001101100100} 


After the addition of the output from generate additional errors the bits in positions 
{8, 30, 11, 15, and 2} are inverted, thereby correcting the 5 additional errors to form 
the less corrupted codeword: 


{01101001100001011000001101100110} 


As in the first approach, this corrupted codeword is permuted, the syndromes calcu- 
lated and the errors plus erasures corrected to retrieve the original message: 


{0, 1,0, 1, 1, 1, 0, 0, 0, 0, 0, 1} 


format into беа Ы: | а permute errors and erasures 
cryptogram corrupted codewords p 0% i bits correction 
input 
position private descramble format 
vector key ips. message 
generate additional number of additional 


Fig. 19.6 Private key decryption system with s random bit errors, 2(t — s) bit deletions and a 
random number of additional errors 
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Fig. 19.7 Position vector generated by hash of message vector and nonlinear feedback shift register 


In a further option, the position vector, instead of being a static vector, may 
be derived from a cryptographic hash of a previous message vector. Any standard 
cryptographic hash function may be used such as SHA-256 [11] or SHA-3 [12] as 
shown in Fig. 19.7. The message vector of length k bits is hashed using SHA-256 or 
SHA-3 to produce a binary hash vector of length 256 bits. 

For example, the binary hash vector may be input to a nonlinear feedback shift 
register consisting of shift register having p stages, typically 64 stages with outputs 
determined by select taps enabling different scrambling keys to be used by selecting 
different outputs. The nonlinear feedback shift register arrangement to produce a 
position vector in error positions buffer memory is the same as that of Fig. 19.3 
whose operation is described above. 

As the hash vector is clocked into the nonlinear feedback shift register of Fig. 19.7, 
a derived position vector is stored in error positions buffer memory, and used for 
encrypting the message vector as described above. The current message vector is 
encrypted using a position vector derived from the hash of the previous message 
vector. As the recipient of the cryptogram has decrypted the previous message vec- 
tor, the recipient of the cryptogram can use the same hash function and nonlinear 
feedback shift register to derive the position vector in order to decrypt the current 
corrupted codeword. There are a number of arrangements that may be used for the 
first codeword. For example, a static position vector, known only to the sender and 
recipient of the cryptogram could be used or alternatively a position vector derived 
from a fixed hash vector known only to the sender and recipient of the cryptogram 
or the hash of a fixed message known only to the sender and recipient of the cryp- 
togram. А simpler arrangement may be used where the shift register has no feedback 
so that the position vector is derived directly from the hash vector. In this case the 
hash function needs to produce a hash vector >п, the length of the codeword. 

As discussed earlier, the original McEliece system is vulnerable to chosen- 
plaintext attacks. If the same message is encrypted twice, the difference between 
the two cryptograms is just 2t bits or less, the sum of the two error patterns. This 
vulnerability is completely solved by encrypting or scrambling the plaintext prior to 
the McEliece system, using the error pattern as the key. To do this, the random error 
pattern needs to be generated first before the codeword is constructed by encoding 
with the scrambled generator matrix. 
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This scrambler which is derived from the error vector, for each message vector, 
may be implemented in a number of ways. The message vector may be scrambled 
by multiplying by ak x k non-singular matrix derived from the error vector. 

Alternatively, the message vector may be scrambled by treating the message vector 
as a polynomial m; (x) of degree k — 1 and multiplying it by a circulant polynomial 
pi(x) modulo 1 + x* which has an inverse [7]. The circulant polynomial p; (x) is 
derived from the error vector. Denoting the inverse of the circulant polynomial p; (x) 
as 41(х) then 

рода) = 1 modulo 1 + x‘ (19.29) 


Accordingly the scrambled message vector is mı (x)pı (x) which is encoded into a 
codeword using the scrambled generator matrix. Each message vector is scrambled 
in a different way as the error patterns are random and different from corrupted 
codeword to corrupted codeword. The corrupted codewords form the cryptogram. 
On decoding of each codeword, the corresponding error vector is obtained with 
retrieval of the scrambled message vector. Considering the above example, the circu- 
lant polynomial p, (x) is derived from the error vector and the inverse qı (х) is calcu- 
lated using Euclid’s method [7] from p; (x). The original message vector is obtained 
by multiplying the retrieved scrambled message vector m; (х)р (x) by pı (x) because 


mı Q)piGoqi(x) = mı (x) modulo 1 + x (19.30) 


Another method of scrambling each message vector using a scrambler derived 
from the error vector is to use two nonlinear feedback shift registers as shown in 
Fig. 19.8. The first operation is for the error vector, which is represented as а s-bit 
sequence is input to a modulo 2 adder add whose output is input to shift register A as 
shown in Fig. 19.8. The nonlinear feedback shift registers are the same as in Fig. 19.3 
with operation as described above but select taps will usually have a different setting 
and nonlinear mapping also will usually have a different mapping, but this is not 
essential. After clocking the s-bit error sequence into the nonlinear feedback shift 
register, shift register A shown in Fig. 19.8 will essentially contain a random binary 
vector. This vector is used by define taps to define which outputs of shift register B 
are to be input to nonlinear mapping B whose outputs are added modulo 2 to the 
message vector input to form the input to shift register B shown in Fig. 19.8. The 
scrambling of the message vector is carried out by a nonlinear feedback shift register 
whose feedback connections are determined by a random binary vector derived from 
the error vector, the s-bit error sequence. 

The corresponding descrambler is shown in Fig. 19.9. Following decoding of 
each corrupted codeword, having correcting the random errors and bit erasures, the 
scrambled message vector is obtained and the error vector is in the form of the s-bit 
error sequence. As in the scrambler, the s bit error sequence is input to a modulo 
2 adder add whose output is input to shift register A as shown in Fig. 19.9. After 
clocking the s-bit error sequence into the nonlinear feedback shift register, shift 
register A shown in Fig. 19.9 will contain exactly the same binary vector as shift 
register A of Fig. 19.8. Consequently, exactly the same outputs of shift register B to 
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Fig. 19.8 Message vector scrambling by nonlinear feedback shift register with taps defined by s-bit 
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Fig.19.9 Descrambling independently each scrambled message vector by nonlinear feedback shift 
register with taps defined by s-bit error pattern 


be input to non linear mapping B will be defined by define taps. Moreover, comparing 
the input of shift register B of the scrambler Fig. 19.8 to the input of shift register B 
of the descrambler Fig. 19.9 it will be seen that the contents are identical and equal 
to the scrambled message vector. 
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Consequently, the same selected shift register outputs will be identical and with 
the same nonlinear mapping nonlinear mapping B the outputs of nonlinear mapping 
B in Fig. 19.9 will be identical to those that were the outputs of nonlinear mapping В 
in Fig. 19.8. The result of the addition of these outputs modulo 2 with the scrambled 
message vector is to produce the original message vector at the output of add in 
Fig. 19.9. 

This is carried out for each scrambled message vector and associated error vector 
to recover the original message. 

In some applications, a reduced size cryptogram is essential perhaps due to limited 
communications or storage capacity. For these applications, a simplification may be 
used in which the cryptogram consists of only one corrupted codeword containing 
random errors, the first codeword. The following codewords are corrupted by only 
deleting bits. The number of deleted bits is 27 bits per codeword using a position 
vector as described above. 

For example, with n = 1024, and the Goppa code correcting t = 60 bit errors, 
there are 21 bits deleted per codeword so that apart from the first corrupted codeword, 
each corrupted codeword is only 904 bits long and conveys 624 message vector bits 
per corrupted codeword. 

A similar approach is to hash the error vector of the first corrupted codeword 
and use this hash value as the key of a symmetric encryption system such as the 
Advanced Encryption Standard (AES) [10] and encrypt any following information 
this way. Effectively, this is AES encryption operating with a random session key 
since the error pattern is chosen randomly as in the classic, hybrid encryption system. 


19.3 Reducing the Public Key Size 


In the original McEliece system, the public key is the k x n generator matrix which can 
be quite large. For example with n — 2048 and k — 1148, the generator matrix needs 
to be represented by 1148 x 2048 = 2.35x 10° bits. Representing the generator matrix 
in reduced echelon form reduces the generator matrix to k x (n—k) = 1.14x 10 bits. 
In then = 32 example above, the generator matrix is the 12 x 32 matrix, PSG(, 12, 9), 
given by Eq.(19.26). Rows of this matrix may be added together using modulo 2 
arithmetic so as to produce a matrix with К independent columns. This matrix is a 
reduced echelon matrix, possibly permuted to obtain К independent columns, and 
may be straightforwardly derived by using the Gauss-Jordan variable elimination 
procedure. With permutations, there are a large number of possible solutions which 
may be derived and candidate column positions may be selected, either initially in 
consecutive order to determine a solution, or optionally, selected in random order to 
arrive at other solutions. 

Consider as an example the first option of selecting candidate column positions 
in consecutive order. For the РС (з2 12,9) matrix (19.26), the following permuted 
reduced echelon generator matrix is produced: 
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100000000000010011010101000111117] 
01000000001000001001000100101110 
00100000000001010010111100110000 
00010000001101001010000101000010 
00001000000101001111010010001001 
00000100000100000100110111111101 

PSGRa21,9—|60000010001100000010110010011001 (19.31) 
00000001001101001111110001100111 
00000000100000000110100110110011 
00000000011000011100101110010100 
00000000000010011010101111000111 

[000000000000001101010111110 01101 


The permutation defined by the following input and output bit position sequences is 
used to rearrange the columns of the permuted, reduced echelon generator matrix. 


0123456789 12 141011 13 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 (19.32) 
012345678910 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 ` 


This permutation produces a classical reduced echelon generator matrix [7], denoted 
as Qu, 12,9): 


100000000000001011010101000111117] 
01000000000010001001000100101110 
00100000000000110010111100110000 
00010000000011101010000101000010 
0000100000000110111101001000100 
0000010000000100010011011111110 

Q82.12,9 = | 9000001000001100001011001001100 (19.33) 
0000000100001110111111000110011 
0000000010000000011010011011001 
00000000010010011100101110010100 
0000000000100001101010111100011 

(00000000000100010101011111010 10j 


Codewords generated by this matrix are from a systematic code [7] with the first 
12 bits being information bits and the last 20 bits being parity bits. Correspond- 
ingly, the matrix above, Qa, 12, 9) consists of an identity matrix followed by a matrix 
denoted as QT(?, 12,9) which defines the parity bits part of the generator matrix. 
The transpose of this matrix is the parity check matrix of the code [7]. As shown in 
Fig. 19.10, the public key consists of the parity check matrix, less the identity sub- 
matrix, and a sequence of n numbers representing a permutation of the codeword bits 
after encoding. By permuting the codewords with the inverse permutation, the result- 
ing permuted codewords will be identical to codewords produced by PSG(, 12, 9), 
the public key of the original McEliece public key system [8]. However, whilst the 
codewords are identical, the information bits will not correspond. 

The permutation is defined by the following input and output bit position 
sequences. 


0123456789 12 1410 11 13 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 (19.34) 
012345678910 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 ` 
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Fig. 19.10 Reduced size public key encryption system 


As the output bit position sequence is just a sequence of bits in natural order, the 
permutation may be defined only by the input bit position sequence. 

In this case, the public key consists of an n position permutation sequence and in 
this example the sequence chosen is: 


012345678912 141011 13 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 


(19.35) 


and the х (n — k) matrix, QT 32, 12, 9), which in this example is the 12 x 20 matrix: 


QT(32.12,9 = 
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(19.36) 


The public key of this system is much smaller than the public key of the original 
McEliece public key system, since as discussed below, there is no need to include 
the permutation sequence in the public key. 
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The message is split into message vectors of length 12 bits adding padding bits 
as necessary so that there is an integral number of message vectors. Each message 
vector, after scrambling, is encoded as a systematic codeword using QT (32, 12, 9), part 
of the public key. Each systematic codeword that is obtained is permuted using the 
permutation (19.35), the other part of the public key. The resulting codewords are 
identical to codewords generated using the generator matrix РЅС (з2 12, 9) (19.26), the 
corresponding public key of the original McEliece public key system, but generated 
by different messages. 

It should be noted that it is not necessary to use the exact permutation sequence 
that produces codewords identical to that produced by the original McEliece public 
key system for the same Goppa code and input parameters. As every permutation 
sequence has an inverse permutation sequence, any arbitrary permutation sequence, 
randomly generated or otherwise, may be used for the permutation sequence part 
of the public key. The permutation sequence that is the inverse of this arbitrary 
permutation sequence is absorbed into the permutation sequence used in decryption 
and forms part of the private key. The security of the system is enhanced by allowing 
arbitrary permutation sequences to be used and permutation sequences do not need 
to be part of the public key. 

The purpose of scrambling each message vector using the fixed scrambler shown 
in Fig. 19.10 is to provide a one-to-one mapping between the 2“ possible message 
vectors and the 2“ scrambled message vectors such that the reverse mapping, which 
is provided by the descrambler, used in decryption, produces error multiplication if 
there are any errors present. For many messages, some information can be gained 
even if the message contains errors. The scrambler and corresponding descrambler 
prevents information being gained this way from the cryptogram itself or by means 
of some error guessing strategy for decryption by an attacker. The descrambler is 
designed to have the property that it produces descrambled message vectors that 
are likely to have a large Hamming distance between vectors for input scrambled 
message vectors which differ in a small number of bit positions. 

There are a number of different techniques of realising such a scrambler and 
descrambler. One method is to use symmetric key encryption such as the Advanced 
Encryption Standard (AES) [10] with a fixed key. 

An alternative means is provided by the scrambler arrangement shown in 
Fig. 19.11. The same arrangement may be used for descrambling but with differ- 
ent shift register taps and is shown in Fig. 19.12. Denoting each k bit message vector 
as a polynomial m(x) of degree k — 1: 


m(x) = mo + mix + max? + max? eec my 4x1 (19.37) 
and denoting the tap positions determined by define taps of Fig. 19.11 by u(x) where 
шх) = ио + шх + шох? иа... шал! (19.38) 


where the coefficients uo through to ug—ı have binary values of 1 or 0. 
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Fig. 19.11 Scrambler arrangement 
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Fig. 19.12 Descrambler arrangement 


The output of the scrambler, denoted by the polynomial, scram(x), is the scram- 
bled message vector given by the polynomial multiplication 
scram(x) = m(x).u (x) modulo (1+ x) (19.39) 
The scrambled message vector is produced by the arrangement shown in Fig. 19.11 
after shift register A with k stages and shift register B with k stages have been clocked 
2k times and is present at the input of shift register B with k stages whose last stage 
output is connected to the adder, adder input. The input of shift register B with k 
stages corresponds to the scrambled message vector for the next additional k clock 
cycles, with these bits defining the binary coefficients of scram(x). The descrambler 
arrangement is shown in Fig. 19.12 and is an identical circuit to that of the scrambler 
but with different tap settings. The descrambler is used in decryption. 
For k = 12 an example of a good scrambler polynomial, u(x) is 
p(x) 2 1-- x - x* x) 420849? 4x" (19.40) 
For brevity, the binary coefficients may be represented as a binary vector. In this 
example, u(x) is represented as {110011001101}. This is a good scrambler 
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polynomial because it has a relatively large number of taps (seven taps) and its 
inverse, the descrambler polynomial also has a relatively large number of taps (seven 
taps). The corresponding descrambler polynomial, 0 (x) is 


Өх) -1xLr Ra xx x (19.41) 


which may be represented by the binary vector (11011001100 1}. It is straight- 
forward to verify that 


u(x) xox) = 1HE Ht Бә Hai x8 4 x10 
байы + xl6 4 x! + x8 + х20 + 22 (19.42) 
= 1 modulo (1--х9 


and so 
scram(x) x 0(x) = m(x) modulo (1 + x*) (19.43) 


As a simple example of a message, consider that the message consists of a single 
message vector with the information bit pattern (0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1} and 
50: 

m(x) = x +x 4 x! (19.44) 


This is input to the scrambling arrangement shown in Fig. 19.11. The scrambled 
message output is scram(x) = m(x) x u(x) given by 


тойла epar + +3 + 3° ta (x 4x Hx + х!) 
= хх +e + x$ pr + x10 x 
+ Хх? + х^ +x! + х + xl px + х 
q xl! p gl 4 x15 4 16 4 419 4 20 4 22 
modulo (1 + х!2) 
= І+х +25 +x + x? 


(19.45) 


and the scrambling arrangement shown in Fig. 19.11 produces the scrambled message 
bit pattern (1, 1, 0, 0, 0, 1, 1, 0, O, 1, 0, 0). 

Referring to Fig. 19.10, the next stage is to use the parity check matrix part of 
the public key to calculate the parity bits from the information bits. Starting with 
an all 0’s vector, where the information bit pattern is a 1, the corresponding row 
from QT 32, 12, 9) (19.36) with the same position is added modulo 2 to the result so 
far to produce the parity bits which with the information bits will form the digital 
cryptogram plus added random errors after permuting the order of the bits. In this 
example, this codeword is generated from adding modulo 2, rows 1, 2, 6, 7 and 10 
of QT, 12, 9) to produce: 
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00 0 I1 0 0101000 1 1 
10001001000100101 10 
01000 00 1 10 1 1 1 I 1101 
(19.46) 
1000010 100 00 1001 
00 1 0010 1 00 0 00 
HoH H H H H oH HB H HH OH HH HH HH OH HH 
101 1 10 11 011000001 


The resulting systematic code, codeword is: 
11000110010010111110111011000001) 


The last step in constructing the final codeword which will be used to construct 
the cryptogram is to apply an arbitrary preset permutation sequence. Referring to 
Fig. 19.10, the operation assemble n bit codewords from n-k parity bits and k message 
bits simply takes each codeword encoded as a systematic codeword and applies the 
preset permutation sequence. 

In this example, the permutation sequence that is used is not chosen arbitrarily 
but is the permutation sequence that will produce the same codewords as the original 
McHliece public key system for the same Goppa code and input parameters. The 
permutation sequence is: 


01234567891214 10 11 13 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 3031 (19.47) 


The notation is that the 10th bit should move to the 12th position, the 11th bit 
should move to the 14th position, the 12th bit should move to the 10th position, 
the 13th bit should move to the 11th position, the 14th bit should move to the 13th 
position and all other bits remain in their same positions. 

Accordingly, the permuted codeword becomes: 


{11000110011001011110111011000001} 


and this will be the input to the adder, add of Fig. 19.1. 

The Goppa code used in this example can correct up to 4 errors, (t = 4), апа а 
random number is chosen for the number of bits to be in error, (s) with s « 4. 

A truly random source such as a thermal noise source as described above pro- 
duces the most secure results, but a pseudorandom generator can be used instead, 
particularly if seeded from the time of day with fine time resolution such as 1115. If 
the number of random errors chosen is too few, the security of the digital cryptogram 
will be compromised. Correspondingly, the minimum number of errors chosen is a 
design parameter depending upon the length of the Goppa code and 1, the number 
of correctable errors. A suitable choice for the minimum number of errors chosen in 
practice lies between 5 and /. If the cryptogram is likely to be subject to additional 
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errors due to transmission over a noisy or interference prone medium such as wire- 
less, or stored and read using an imperfect reader such as in barcode applications, 
then these additional errors can be corrected as well as the deliberately introduced 
errors provided the total number of errors is no more than f errors. 

For such applications typically the number of deliberate errors is constrained to 
be between $ and 2. 

For the example above, consider that the number of bit errors is 3 and these are 
randomly chosen to be in positions 4, 11 and 27 (starting the position index from 0). 
The bits in these positions in the codeword are inverted to produce the result 


П1001110011101011110111011010001) 


Тһе dcryptogram is this corrupted codeword, which is transmitted or stored depend- 
ing upon the application. 

The intended recipient of this cryptogram retrieves the message in a series of 
steps. Figure 19.13 shows the system used for decryption. The retrieved cryptogram 
is formatted into corrupted codewords by format into corrupted codewords shown 
in Fig. 19.4. For the example above, the recipient first receives or otherwise retrieves 
the cryptogram, which may contain additional errors. 


П1001110011101011110111011010001). 


It is assumed in this example that no additional errors have occurred although with 
this particular example one additional error can be accommodated. 

The private key contains the information of which Goppa code was used and a 
first permutation sequence which when applied to the retrieved, corrupted codewords 
which make up the cryptogram produces corrupted codewords of the Goppa code 
with the bits in the correct order. Usually, the private key also contains a second 
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Fig. 19.13 Private key decryption system 


19.3 Reducing the Public Key Size 495 


permutation sequence which when applied to the error-corrected Goppa codewords 
puts the scrambled information bits in natural order. Sometimes the private key also 
contains a third permutation sequence which when applied to the error vectors found 
in decoding the corrupted corrected Goppa codewords puts the bit errors in the same 
order that they were when inserted during encryption. АП of this information is stored 
in private key in Fig. 19.13. Other information necessary to decrypt the cryptogram, 
such as the descrambler required may also be stored in the private key or be implicit. 

There are two permutation sequences stored as part of the private key and the 
decryption arrangement is shown in Fig. 19.13. The corrupted codewords retrieved 
from the received or read cryptogram are permuted with a first permutation sequence 
which will put the bits in each corrupted codeword in the same order as the Goppa 
codewords. In this example, the first permutation sequence stored as part of the 
private key is: 


24 11 3 23 2 17 20 8 13 3031 14 15 22 7 1 9 6214 10 528 26 19 16 25 027 12 18 29 (19.48) 


This defines the following permutation input and output sequences: 


01234 5 6 789 1011 I2 13 14 I5 16 17 18 19 20 21 22 23 24 25 26 27 28 29 3031 (19.49) 
27 154219 21 17 147 1620 1 29 8 11 1225 5 3024 6 1813 3 0 2623282231 9 10 i 


so that for example bit 23 becomes bit 3 after permutation and bit 30 becomes bit 9 
after permutation. The resulting, permuted corrupted codeword is: 


{11000110101011011111110001111010} 


The permutation is carried out by permute corrupted codeword bits shown in 
Fig. 19.13 with the first permutation sequence input from private key. 

Following the permutation of each corrupted codeword, the codeword bits are 
in the correct order to satisfy the parity check matrix, matrix (19.19) if there were 
no codeword bit errors. (In this case all of the syndrome values would be equal 
to 0). The next step is to treat each bit in each permuted corrupted codeword as a 
GF (2°) symbol with a 1 equal to œ? and a 0 equal to 0 and use the parity check matrix, 
matrix (19.19), stored as part of private key to calculate the syndrome values for each 
row of the parity check matrix. The syndrome values produced in this example, are 
respectively 030, 027, o^, anda’. In Fig. 19.13 error-correction decoder calculates 
the syndromes as a first step in correcting the bit errors. 

The bit errors are corrected using the syndrome values to produce an error free 
codeword from the Goppa code for each permuted corrupted codeword. There 
are many published algorithms for correcting bit errors for Goppa codes, but the 
most straightforward is to use a BCH decoder as described by Retter [13] because 
Berlekamp-Massey may then be used to solve the key equation. After decoding, the 
error free permuted codeword is obtained: 
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(10000110101011011110110001110010] 

and the error pattern, defined as a 1 in each error position is 
{0 1000000000000000001000000001000}. 


As shown in Fig. 19.13 permute codeword bits takes the output of error-correction 
decoder and applies the second permutation sequence stored as part of the private 
key to each corrected codeword. 

Working through the example, consider that the following permutation input and 
output sequences is applied to the error free permuted codeword (the decoded code- 
word of the Goppa code). 


271542 19 21 17 147 1620 1 29 8 11 1225 5 3024 6 1813 3 0 26 23 28 2231 9 10 (19.50) 
01234 5 6 789 1011 I2 13 14 I5 16 17 18 19 20 21 22 23 24 25 26 27 28 29 3031 М 


The result is that the scrambled message bits correspond to bit positions: 
(01234567891214] 


from the encryption procedure described above. The scrambled message bits may be 
repositioned in bit positions: 


101234567891011) 


by absorbing the required additional permutations into a permutation sequence 
defined by the following permutation input and output sequences: 


27 154219 21 17 147 1629 1120 8 1 1225 5 3024 6 1813 3 0 2623282231 9 10 (19.51) 
01234 5 6 789 1011 I2 13 14 I5 16 17 18 19 20 21 22 23 24 25 26 27 28 29 3031 ` 


The second permutation sequence which corresponds to this net permutation and 
which is stored as part of the private key, private key shown in Fig. 19.13 is: 


24 14 3 23 2 17 208 13 3031 11 15 22 7 1 9 6214 12 528 26 19 16 25 0 27 10 18 29 (19.52) 


The second permutation sequence is applied by permute codeword bits. Since 
the encryption and decryption permutation sequences are all derived at the same 
time in forming the public key and private key from the chosen Goppa code, it is 
straightforward to calculate and store the net relevant permutation sequences as part 
of the private key. 
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Continuing working through the example, applying the second permutation 
sequence to the error free permuted codeword produces the output of permute code- 
word bits. The first 12 bits of the result will be the binary vector, (1 10001100100} 
and it can be seen that this is identical to the scrambled message vector produced 
from the encryption operation. Represented as a polynomial the binary vector is 
1+х +2? +7°42?. 

As shown in Fig. 19.13, the next step is for the k information bits of each per- 
muted error free codeword to be descrambled by descramble information bits. 
In this example, descramble information bits is carried out by the descrambler 
arrangement shown in Fig.19.12 with define taps corresponding to polynomial 
1 4x4 x x x 4x82 х1. 

The output of the descrambler in polynomial form is (1 + x 4-3? + x6 + 3?).(1-4- 
x 4 x? ^. x* + x? + x8 + x1!) modulo 1 + x!?. After polynomial multiplication, the 
result is (x + x? + x!!) corresponding to the message 


{010100000001} 


Itis apparent that this is the same as the original plaintext message prior to encryption. 

With each cryptogram restricted to contain s errors, the cryptosystem as well 
as providing security, is able automatically to correct t — s errors occurring in the 
communication of the cryptogram as shown in Fig. 19.14. It makes no difference 
to the decryption arrangement of Fig. 19.13, whether the bit errors were introduced 
deliberately during encryption or were introduced due to errors in transmitting the 
cryptogram. À correct message is output after decryption provided the total number 
of bit errors is less than or equal to f, the error-correcting capability of the Goppa 
code used to construct the public and private keys. 

As an illustration, a (512, 287, 51) Goppa code of length 512 bits with message 
vectors of length 287 bits can correct up to 25 bit errors, (t = 25). With s = 15, 
15 bit errors are added to each codeword during encryption. Up to 10 additional bit 
errors can occur in transmission of each corrupted codeword and the message will 
be still recovered correctly from the received cryptogram. 


biblicky private key 

| communications decrypt correctin 
encrypt with medium with t E s 
s < t errors transmission errors 


message output 
message input 


Fig. 19.14 Public key encryption system correcting communication transmission errors 
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The system will also correct errors in the reading of cryptograms stored in data 
media. As an example a medium to long range ISO 18000 6B RFID system operating 
in the 860-930 МН? with 2048 bits of user data can be read back from a tag. A (2048, 
1388, 121) Goppa code of length 2048 bits with message vectors of length 1388 bits 
can correct 60 errors, (t = 60). With s = 25, 25 bit errors are added to the codeword 
during encryption and this is written to each passive tag as a cryptogram, stored in 
non-volatile memory. As well as providing confidentiality of the tag contents, up to 
35 additional biterrors can be tolerated in reading each passive tag, thereby extending 
the operational range. The plaintext message, the encrypted tag payload information 
of 1388 bits will be recovered more reliably with each scanning of the tag. 


19.4 Reducing the Cryptogram Length Without 
Loss of Security 


In many applications a key encapsulation system is used. This is a hybrid encryption 
system in which a public key cryptosystem is used to send a random session key to 
the recipient and a symmetric key encryption system, such as AES [10] is used to 
encrypt the following data. Typically a session key is 256 bits long. To provide the 
same 256 bit security level a code length of 8192 bits needs to be used, with a code 
rate of 0.86. Security analysis of the McEliece system is provided in Sect. 19.5. The 
Goppa code is the (8192, 7048, 177) code. There are 7048 information bits available 
in each codeword, but only 256 bits are needed to communicate the session key. The 
code could be shortened in the traditional manner by truncating the generator matrix 
but this will leave less room to insert the ¢ errors thereby reducing the security. The 
obvious question is can the codeword be shortened without reducing the security? 

Niederreiter [9] solved this problem by transmitting only the n — k bits of the syn- 
drome calculated from the error pattern. Niederreiter originally proposed in his paper 
а system using Generalised Reed-Solomon codes but this scheme was subsequently 
broken with an attack by Sidelnikov and Shestakov [15]. However their attack fails 
if binary Goppa codes are used instead of Generalised Reed-Solomon codes and the 
Niederreiter system is now associated with the transmission of the n — k parity bits 
as syndromes of the McEliece system. 

It is unfortunate that only a tiny fraction of the 27-5 syndromes correspond to 
correctable error patterns. For the (8192, 7048, 177) Goppa code, it turns out that there 
аге 2697 correctable syndromes out of the total of 21144 syndromes. The probability 
of an arbitrary syndrome being decoded is 2447 around 3 x 107135, This is the 
limitation of the Niederreiter system. The plaintext message has to be mapped into an 
error pattern consisting of t bits uniformly distributed over n bits. Any deterministic 
method of doing this will be vulnerable to a chosen-plaintext attack. Of course 
the Niederreiter system can be used to send random messages, first generated as a 
random error pattern, as in a random session key. However, additional information 
really needs to be sent as well, such as a MAC, timestamp, sender ID, digital signature 
or other supplementary information. 
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Fig. 19.15 Public key encryption system with shortened codewords 


One solution is to use the system shown in Fig. 19.15. The plaintext message, M, 
consisting of a 256 bit random session key concatenated with 512 bits of supple- 
mentary information such as a MAC, time stamp and sender ID is encrypted in the 
encryption module with a key that is a cryptographic hash, such as SHA-3 [12], of 
the error pattern. The encrypted message is Me. The error pattern consists of t bit 
errors randomly distributed over n bits. This bit pattern is partitioned into three parts, 
A, B and C as shown in Fig. 19.16. Using the (8192, 7048, 177) Goppa code, part A 
covers the first 6280 bits, part B covers the next 768 bits and part C covers the last 
1144 bits, the parity bits. 

The public key encoder consists of the public key generator matrix in reduced 
echelon form which is used to encode information bits consisting of part A, con- 
catenated with M, as shown in Fig. 19.15. After encoding, the n — k parity bits of 
the codeword are P(A) + Р(М.). The codeword is then shortened by removing the 
first 6280 bits of the codeword. The error pattern parts B and C are added to the 
shortened codeword of length 1912 bits to form the ciphertext of length 1912 bits. 
The format of the various parts of the error pattern, the hash derivation, encryption 
and codeword are shown in Fig. 19.16. 

The principle that this system uses, is that the syndrome of any codeword is zero 
and that the cryptosystem is linear. The codeword resulting from the encoding of A 
is {A 0... 0 P(A)}, where P(A) are the parity bits. The sum of syndromes from 
sections, of this codeword must be zero. Hence: 


Syndrome(A) + 0... 0 +Р(А) = 0 
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Fig. 19.16 Format of the shortened codeword and error pattern 


As the base field is 2, 
Syndrome(A) = P(A) 


Consequently, by including P(A) instead of the error bits, part A in the ciphertext 
results in the same syndrome being calculated in the decoder, namely P(A) + P(B) + 
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Fig. 19.17 Decryption method for the shortened ciphertext 
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P(C). Removing error pattern, part A shortens the ciphertext whilst including P(A) 
instead requires no additional bits in the ciphertext. Since it is necessary to derive 
the complete error pattern of length n bits in order to decrypt the ciphertext, there is 
no loss of security from shortening the ciphertext. 

The method used to decrypt the ciphertext by using the private key is shown in 
Fig. 19.17. The received ciphertext is padded with leading zeros to restore its length 
to 8192 bits. This is then permuted to be in the same order as the Goppa code and the 
parity check matrix of the Goppa code is used to calculate the syndrome. A Goppa 
code error-correcting decoder is then used to find the permuted error pattern A, B 
and C from this syndrome. The most straightforward error-correcting decoder to use 
is based on Retter's decoding method [13]. This involves calculating a syndrome 
having 2(n — К) parity bits from the parity check matrix of g?(z) where g(z) is the 
Goppa polynomial of the code, then using the Berlekamp-Massey method to solve 
the key equation as in a standard BCH decoder to find the error bit positions. It is 
because the codewords are binary codewords and the base field is 2, that the Goppa 
code codewords satisfy the parity checks of g?(z) as well as the parity checks of 
g(z), since 12 = 1. 

As shown in Fig. 19.17, once the error pattern is determined, it is inverse permuted 
to produce A, B and C which is hashed to produce the decryption key needed to 
decrypt M, back into the plaintext message M. Part B of the derived error pattern is 
added to the M, + B contained in the received ciphertext to produce M, as shown in 
Fig. 19.17. 


19.5 Security of the Cryptosystem 


If we consider the parameters that Professor McEliece originally chose, a code of 
length 1024 bits correcting 50 errors and 524 information bits, then a brute force 
attack may be based on guessing the error pattern, adding this to the cryptogram and 
checking if the result is a valid codeword. Checking if the result is a codeword is 
easy. By using elementary matrix operations on the public key, the generator matrix, 
we can turn it into a reduced echelon matrix whose transpose is the parity check 
matrix. We simply use this parity check matrix to calculate the syndrome of the n bit 
input vector. If the syndrome is equal to zero then the input vector is a codeword. 

The maximum number of syndromes that need to be calculated is equal to the 
number of different error patterns which is () = (124) = 3.199 ~ 2284 This may 
be described as being equivalent to a symmetric key encryption system with a key 
length of 284 bits. 

However, there are much more efficient ways of determining the error pattern 
in the cryptogram. An attack called information set decoding [2] as described by 
Professor McEliece in his original paper [8], may be used. For any (n, k, d) code, k 
columns of the generator matrix may be randomly selected and using Gauss-Jordan 
elimination of the rows, there is a probability that a permuted, reduced echelon 
generator matrix will be obtained which generates the same codeword as the original 
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code. The k x k sub-matrix resulting from the k selected columns needs to be full 
rank and the probability of this depends on the particular code. For Goppa codes 
the probability turns out to be the same as the probability of a randomly chosen 
k x k binary matrix being full rank. This probability is 0.2887 as described below 
in Sect. 19.5.1. 

Given a cryptogram containing f errors an attacker can select k bits randomly, con- 
struct the corresponding permuted, reduced echelon generator matrix with a chance 
of 0.29. The attacker then uses the matrix to generate a codeword and finds the 
Hamming distance between this codeword and the cryptogram. If the Hamming 
distance is exactly т then the cryptogram has been cracked. 

For this to happen all of the К selected bits from the cryptogram need to be error 
free. The probability of this is: 


k-1 


с.с (n — t)!(n — К)! 


n—i (n — t — K)!n! 


i=0 


Including the chance of 0.29 that the selected matrix has rank k, the average number 
of selections of k bits from the cryptogram before the cryptogram is cracked, Neg is 
given by 

_ (n — t — k)!In! 

^. 029(n — t)!(n — k)! 


Nek (19.53) 


For the original code parameters (1024, 524, 101), М = 4.78 x 1016 zz 255. 

This is equivalent to a symmetric key encryption system with a key length of 55 
bits, alotless than 284 bits, the base 2 logarithm of the number of error combinations. 

Using alonger code offers much more security. For example using code parameters 
(2048, 1300, 137), Na. = 1.45 x 10?! ~ 219 equivalent to a symmetric key length 
of 103 bits. 

For code parameters (8192, 5124, 473), with a Goppa code which corrects 236 
errors, it turns out that Ng, = 5.60 х 10/03 a; 234, equivalent to a symmetric key 
length of 344 bits. 

The success of this attack depends upon the code rate. The effect of the code rate, 
R and the security as expressed in the equivalent symmetric key length in bits is 
shown in Fig. 19.18 for a code length of 2048 bits. The code rate, R that maximises 
Ne for a given п is tabulated in Table 19.3, together with / the number of correctable 
errors and the equivalent symmetric key length in bits. 


19.5.1 Probability of ak x k Random Matrix Being Full 
Rank 


The probability of a randomly chosen k x k binary matrix being full rank is a classical 
problem related to the erasure correcting capability of random binary codes [4, 5]. 
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Fig. 19.18 Effect of code rate on security for a code length of 2048 bits 


Table 19.3 Optimum code 


am . | п R t Security (bits) 

rate giving maximum security 

as a function of code length 512 0.6309 21 33.0 
1024 0.6289 38 57.9 
2048 0.6294 69 103.5 
4096 0.6279 127 187.9 
8192 0.6287 234 344.6 
16384 0.6292 434 637.4 


For the binary case it is straightforward to derive the probability, P; of ak x k 
randomly chosen matrix being full rank by considering the process of Gauss-Jordan 
elimination. Starting with the first column of the matrix, the probability of finding a 
1 in at least one of the rows is (1 — ЗЫ 

Selecting one of these non-zero bit rows, the bit in the second column will be 
arbitrary and considering the first two bits there are 2! linear combinations. As there 
are 2? combinations of two bits, the chances of not finding an independent 2-bit 
combination in the remaining k — 1 rows are я. Assuming an independent row 
is found, we next consider the third column and the first three bits. There are 2? 
linear combinations of 3 bits from the two previously found independent rows and 


there are a total possible 2? combinations of 3 bits. The probability of not finding an 
1 


independent 3-bit pattern in any of the remaining k — 2 rows is Cy = gei. 
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Table 19.4 Probability of a k P 
; | k 
random binary k x k matrix 
having full rank 5 0.298004 
10 0.289070 
15 0.288797 
20 0.288788 
50 0.288788 


k—1 1 k—i k—1 1 
P, 2 [[1- (: - 5) = |: – Tm (19.54) 
і-0 і 


The probability of P, as a function of k is tabulated in Table 19.4. The asymptote of 
0.288788 is reached for К exceeding 18. 


19.5.2 Practical Attack Algorithms 


Practical attack algorithms of course need to factor in the processing cost of Gauss- 
Jordan elimination compared to the problem of constructing different generator 
matrices. A completely different set of k coordinates does not need to be selected 
each time to generate a different generator matrix as discussed in [2]. Also, even if the 
k selected columns of the generator matrix do not have full rank, usually discarding 
and adding one or two columns will produce a full rank matrix. It can be shown that 
on average only 1.6 additional columns are necessary to achieve full rank. Canteaut 
and Chabaud [3] showed that by including the cryptogram as an additional row in 
the generator matrix of the (n, k, 27 + 1) code, a code is produced with parameters 
(п, k+ 1, t) for which there is only a single codeword with weight t, the original error 
pattern in the cryptogram. In this case algorithms for finding low-weight codewords 
may be deployed to break the cryptogram. However these low-weight codeword 
search algorithms are all very similar to the original algorithm aimed at searching for 
а codeword of the (n, k, 2f-+ 1) code with Hamming distance f from the cryptogram. 
The conclusions of the literature are that information set decoding is an efficient 
method of attacking the McEliece system but that from a practical viewpoint the 
system is unbreakable provided the code is long enough. Bernstein et al. [2] give rec- 
ommended code lengths and their corresponding security, providing similar results 
to that of Table 19.3. 

The standard McEliece system is vulnerable to chosen-plaintext attacks. The 
encoder is the public key, usually publically available, and the attacker can simply 
guess the plaintext, construct the corresponding ciphertext and compare this to the 
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target ciphertext. In addition, if the same plaintext message is encrypted twice the 
sum of the two ciphertexts is a n bit vector of 27 bits or less. 

The standard McEliece system is also vulnerable to chosen-ciphertext attack. 
Assuming a decryption oracle is available, the attacker inverts two bits randomly in 
the ciphertext and sends the result to the decryption oracle. With probability Іше) , 
a different ciphertext will be produced containing exactly t errors and the decryption 
oracle will output the plaintext, breaking the system. 

Encrypting the plaintext using a key derived from the error pattern, as described 
above, defeats all of these attacks. 


19.6 Applications 


Public key encryption is attractive in a wide range of different applications, partic- 
ularly those involving communications because the public keys may be exchanged 
initially using clear text messages followed by information encrypted using the public 
keys. The private keys remain private because they do not need to be communicated 
and the public keys are of no help to an eavesdropper. 

An example of an application for the iPhone and iPad using the McEliece public 
key encryption system is the S2S app pictured in Fig. 19.19. In this app, files are 
encrypted with users' public keys and stored in the cloud so that they may be shared. 
Sharing is by means of links that index the encrypted files on the cloud and each user 
uses their private key to decrypt the shared files. 

If the same type of application was implemented using symmetric key encryp- 
tion, it would be necessary for users to share passwords with all of the associated 
risks that entails. Using public key encryption avoids these risks. Another applica- 
tion example is the secure Instant Messaging (IM) system, PQChat for the iPhone, 
iPad and Android devices. There is an option button which shows messages in their 
received encrypted format, as shown in Fig. 19.20. The application is called PQChat 
and the name stands for Post-Quantum Chat as the McEliece cryptosystem is rela- 
tively immune to attack by a quantum computer, unlike the public key encryption 
systems in common use today, such as Rivest Shamir Adleman, (RSA) and Elgamal. 

As with other public key methods, the system may be used for mutual authentica- 
tion. Party X sends a randomly chosen nonce x;, together with a timestamp to Party 
Y using Party Y's public key. Party Y returns a randomly chosen nonce y;, timestamp 
and hash(hash(x;, y1)) to Party X using Party X's public key. Party X replies with 
an encrypted timestamp and acknowlegement, using symmetric key cryptography 
with encryption key Aash(x;, yı), the preimage of hash(hash(x,, y1)), to Party Y. 
The session key hash(x;, yı) is used for further exchanges of information, for the 
duration of the session. А cryptographic hash function is used such as SHA-3 [12] 
which also has good, second preimage resistance. 

Itis assumed that the private keys have been kept secret and the association of IDs 
with public keys has been independently verified. In this case, Party X knows Party Y 
holds the private key of Y and is the only one able to learn хі. Party Y knows Party 
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Fig. 19.19 525 application 
for sharing encrypted files 


| 
Mà Secure To Share 


Let's Get Started 


Setup 


X holds the private key of X and is the only one able to learn у. Consequently Party 
X and Party Y are the only ones with knowledge of x, and yı. Using the preimage 
of hash(hash(xi, у1)) as the session key provides added assurance as both хі and yı 
need to be known in order to generate the key, Ahash(x;, уі). The timestamps prevent 
replay attacks being used. 
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197 Summary 


А completely novel type of public key cryptosystem was invented by Professor 
Robert McEliece in 1978 and this is based on error-correcting codes using Goppa 
codes. Other well established public key cryptosystems are based on the difficulty 
of determining logarithms in finite fields which, in theory, can be broken by quan- 
tum computers. Despite numerous attempts by the crypto community, the McEliece 
system remains unbroken to this day and is one of the few systems predicted to 
survive attacks by powerful computers in the future. In this chapter, some variations 
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to the McEliece system have been described including a method which destroys the 
deterministic link between plaintext messages and ciphertexts, thereby providing 
semantic security. Consequently, this method nullifies the chosen-plaintext attack, 
of which the classic McEliece is vulnerable. It is shown that the public key size can 
be reduced and by encrypting the plaintext with a key derived from the ciphertext 
random error pattern, the security of the system is improved since an attacker has to 
determine the exact same error pattern used to produce the ciphertext. This defeats a 
chosen-ciphertext attack in which two random bits of the ciphertext are inverted. The 
standard McEliece system is vulnerable to this attack. The security of the McEliece 
system has been analysed and a shortened ciphertext system has been proposed which 
does not suffer from any consequent loss of security due to shortening. This is impor- 
tant because to achieve 256 bits of security, the security analysis has shown that the 
system needs to be based on Goppa codes of length 8192 bits. Key encapsulation and 
short plaintext applications need short ciphertexts in order to be efficient. It is shown 
that the ciphertext may be shortened to 1912 bits, provide 256 bits of security and 
an information payload of 768 bits. Some examples of interesting applications that 
have been implemented on a smartphone in commercial products, such as a secure 
messaging app and secure cloud storage app, have been described in this chapter. 
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Chapter 20 
Error-Correcting Codes and Dirty Paper 
Coding 


201 Introduction and Background 


In the following we are concerned with impressing information on an independent 
signal, such as an image or an audio stream with the aim of the additional energy 
used consistent with reliable detection of the information. Information can even be 
impressed on background noise with no apparent signal present. A secondary aim is 
that in impressing the information, the independent signal should suffer a minimal 
amount of degradation or distortion to the point that in some circumstances the 
difference is virtually undetectable. 


20.2 Description of the System 


The following, for simplicity, is first described in terms of using binary codes and 
binary information. Itis shown later that the method may be generalised to non-binary 
codes and non-binary information. The independent signal or noise is denoted by the 
waveform v(t) and the information carrying signal to be impressed on the waveform 
v(t) is denoted by s(t). The resulting waveform w(t) is simply given by the sum: 


w(t) = v(t) + s(t) (20.1) 


The decoder which is used to determine s(t) from the received waveform will 
usually be faced with additional noise, interference and sometimes distortion due 
to the receiving equipment or the transmission. With no distortion, the input to the 
decoder is denoted by r(t) and given by: 


r(t) = v(t) + s(t) + n(t) (20.2) 
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In its simplest form s(t) carries only one bit of information and 
S(t) = koso(t) — kısı (t) (20.3) 
to convey data 0, and 
s(t) = kosi (£) — 1150(1) (20.4) 


to convey data 1. 

The multiplicative constants, ko and kı are chosen to adjust the energy of the 
information carrying signal and kı is used to reduce the correlation of the alternative 
information carrying signal that could cause an error in the decoder. The multi- 
plicative constants, (о and kı are normally chosen as a function of v(t), the main 
component of interference in the decoder, which is attempting to decode r(t). 

In conventional communications, о (ї) (or s; (ї)) is transmitted or stored апа ѕо(7) 
(or s, (f)) is decoded despite the presence of interference or noise. s(t) is added to 
v(t) and so(t) (ог s; (1)) is decoded from the composite waveform v(t) + s(t) despite 
the presence of additional interference or noise. 

Noting that the transmitter has no control over the independent signal or noise у(7), 
a good strategy is to choose so (f) and s; (t) from a large number of possible waveforms 
in order to produce waveforms which have a large correlation with respect to v(t). 
Each possible waveform is constrained to be a codeword from an (n, k, dmin) error- 
correcting code. In one approach using binary codes, the 2^ codewords are partitioned 
into two disjoint classes, codewords having even parity and codewords having odd 
parity. The codeword so(t) is the even parity codeword with highest correlation out 
of all even parity codewords and the codeword s; (f) is the odd parity codeword with 
highest correlation out of all odd parity codewords. The idea is that w(t) should have 
maximum correlation with so(t) if the information data is 0 compared to any of the 
other 2% — 1 codewords. Conversely if the information data is 1, w(t) should have 
maximum correlation with s; (f) compared to any of the other 2* — 1 codewords. As 
there is a minimum Hamming distance of dmin, between codewords, this prevents 
small levels of additional noise or interference causing an error in detecting the data 
in the decoder. 

As an example, consider a typical sequence of 47 Gaussian noise samples v(f) 
as shown in Fig. 20.1. A binary quadratic residue [4] code, described in Chap. 4, the 
(47, 24, 11) code is used and the highest correlation codeword having even parity is 
determined using a near maximum likelihood decoder, the modified Dorsch decoder 
described in Chap. 15. The waveform of Fig. 20.1 is input to the decoder. The highest 
correlation codeword, which has a correlation value of 20.96 is the codeword: 


(010010011001100100100001000010000100 10000000000] 


The highest correlation, odd parity codeword, is then determined. This codeword, 
which has a correlation value of 22.65, is the codeword: 


(111010010110000110011001000100000100 00100000000) 
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Fig. 20.1 Noise waveform to be impressed with data 


It should be noted that in carrying out the correlations, codeword 175 are mapped to 
— 1° and codeword 0’s are mapped to +1’s. 

The information bit to be impressed on the noise waveform is say, data 0, in which 
case the watermarked waveform w(t) needs to produce a maximum correlation with 
an even parity codeword. Correspondingly, the value given to Ko is 0.156 and to 
kı is 0.02 in order to make sure that the codeword which produces the maximum 
correlation with the marked waveform is the previously found even parity codeword: 


(0100100110011001001000010000100001001000000 
0000) 


The marked waveform w(t) is as shown in Fig. 20.2. It may be observed that the 
difference between the marked wavefordm and the original waveform is small. In 
the decoder it is found that the codeword with highest correlation with the marked 
waveform w(t) is indeed the even parity codeword: 


{01001001100110010010000100001000010010000000000 } 


and this codeword has a correlation of 28.31. 

One advantage of this watermarking system over conventional communications 
is that the watermarked waveform may be tested using the decoder. If there is insuf- 
ficient margin, adjustments may be made to the variables kọ and ( and a new 
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Fig. 20.2 Noise waveform impressed with data 0 


watermarked waveform produced. Conversely, if there is more than adequate margin, 
adjustments may be made to the variables kọ and kı, so that there is less degradation 
to the original waveform v(f). 

The highest correlation, odd parity codeword with correlation 25.31 is the code- 
word: 


(111010010110000110011001000100000100 00100000000) 


It should be noted that this odd parity codeword is the same odd parity codeword as 
determined in the encoder, but this is not always the case depending upon the choice 
of values for kọ and ky. 

For the case where the information bit is a 1, the marked waveform w(t) needs to 
produce a maximum correlation with an odd parity codeword. In this case, the value 
of Ко is 0.043 and the value of kı is 0.02 and s(t) = Kos; (t) — kıso(t). The marked 
waveform w(t) is as shown in Fig. 20.3. This time in the decoder it is found that the 
codeword with highest correlation with w(t) is indeed the odd parity codeword: 


(111,01001011000011001100100010000010000100000000) 


and this codeword has а correlation of 24.70. The highest correlation,even parity, 
codeword has a correlation of 22.02. 

In the encoding and decoding procedure above, the maximum correlation code- 
word needs to be determined. For short codes a maximum likelihood decoder [6] 
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Fig. 20.3 Noise waveform impressed with data 1 


may be used. For medium length codes, up to 200 bits long, the near maximum 
likelihood decoder, the modified Dorsch decoder of Chap. 15 is the best choice. For 
longer codes, decoders such as an LDPC decoder [3], turbo code decoder [1], or turbo 
product code decoder [7] may be used in conjunction with the appropriate iterative 
decoder. An example of a decoder for LDPC codes is given in by Chen [2]. 

Once the maximum correlation codeword has been found, codewords with sim- 
ilar, high correlation values, may be found from the set of codewords having small 
Hamming distance from the highest correlation codeword. Linear codes are the most 
useful codes because the codewords with high correlations with the target waveform 
are given by the sum of the highest correlation codeword and the low-weight code- 
words of the code, modulo q, (where GF (q) is the base field [4] of the code). The 
low-weight codewords of the code are fixed and may be derived directly as described 
in Chaps.9 and 13, or determined from the weight distribution of the dual code [4]. 

For practical implementations, the most straightforward approach is to restrict 
the codes to binary codes less than 200 bits long and determine the high correlation 
codewords by means of the modified Dorsch decoder. This conveniently, can output 
a ranked list of the high cross correlation codewords is together with their correla- 
tion values. It is straightforward to modify the decoder so as to provide the output 
codewords in odd and even parity classes, with the maximum correlation codeword 
for each class. The results for the example above were determined in this way. 
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Additional information may be impressed upon the independent signal or noise 
by partitioning the 2^ codewords into more disjoint classes (other than binary). For 
example four disjoint classes may be obtained by partitioning the codewords accord- 
ing to odd and even parity for the odd numbered codeword bits and odd and even 
parity for the even numbered codeword bits. Namely, if the codewords are represented 
as: 


c(x) = co text cx? + cx? + cax* Tee ix s (20.5) 
then the codewords are partitioned according to the values of po and p, given by 


po = со + сә + c4 + €6:-: + ск modulo 2 = 0 
pi = сү + сз + c5 ст · + c2 modulo 2 = 0 


or with the result 


po = со + сә + c4 + C6: -+ + e; modulo 2 = 1 
pi = сү + сз + сз + С ·· +c- modulo 2 = 1 


Clearly the procedure may be extended to m parity bits by partitioning the 2* code- 
words into 2” disjoint classes. In this case, following encoding, m bits of information 
will be conveyed by the marked waveform and determined from the codeword which 
has the highest correlation with the marked waveform. This is by virtue of which of 
the 2" classes this codeword resides. 

An alternative to this procedure is to use non-binary codes [5] with a base field of 
GF (q) as described in Chap. 7. For convenience a base field of GF(2”) may be used 
so that each symbol of a codeword is represented by rn bits. In this case codewords 
are partitioned into 2" classes according to the value of the overall parity sum: 


Po = со + сү + c2 + c3 + CA + Ck modulo 2” (20.6) 


The n non-binary symbols of each codeword may be mapped into n Pulse Ampli- 
tude Modulation (PAM) symbols [6] or into n.m binary symbols or a similar hybrid 
combination before correlation with v(t). 

Rather than maximum correlation with the waveform to be marked, codewords 
may be chosen that have near zero correlation with the waveform to be marked. 
Information is conveyed by the watermarked marked waveform by the addition of a 
codeword to v(t), which is orthogonal or near orthogonal to the codeword which has 
maximum correlation to the independent signal or noise waveform v(t). In this case, 
the codeword with maximum correlation to v(t) is denoted as 5,„ах (7). Codewords 
that are orthogonal or near orthogonal to 55,4, (f) are denoted as 5,„ах, (7) for i = 1 to 
2”. The signal impressed upon v(t) is: 


s(t) = Ко5тах (1) "b KiSmax, i (0) (20.7) 
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where т determines which one of the 2" orthogonal codewords is impressed on the 
waveform to convey the т bits of information data. The addition of the maximum 
correlation codeword koSmax(t) to v(t) is to make sure that ѕ,„„; (1) is still the codeword 
with maximum correlation after the waveform has been marked. Although the code- 
words Smax,i(t) for i = 1 to 2" are orthogonal to koSmax(t) they are not necessarily 
orthogonal to v(t). In this case, the signal impressed upon v(t) needs to be: 


2m 
s(t) = koSmax(t) F >, KiSmax,i(t) (20.8) 


і-і 


The coefficients k; will usually be small in order to produce near zero correlation 
of the codewords 5,„ах ; with w(t) except for the coefficient k; in order to produce а 
strong correlation with the codeword Smax,j- 

The choice of the multiplicative constants, (о and kı or the multiplicative constants 
k; for the general case (these adjust the energy of the components of the information 
signal), depends upon the expected levels of additional noise or interference and 
acceptable levels of decoder error probability. If the marked signal to noise ratio is 
represented as SNR;, the marked signal energy as Е;, and the difference in highest 
correlation to next highest correlation of the codewords is А, then the probability 
of decoder error p(e) is lower bounded by: 

pe) < L erpe (AASR (20.9) 
2 8.Е; 
This is under the assumption that there is only one codeword close in Euclidean 
distance to the maximum correlation codeword. 

The multiplicative constants may be selected “open loop" or “closed loop". In 
"closed loop", which is a further variation ofthe system, the encoding is followed by a 
testing phase. After encoding, the information is decoded from the marked waveform 
and the margin for error determined. Different levels of noise or interference may 
be artificially added to the marked waveform, prior to decoding, in order to assist in 
determining the margin for error. If the margin for error is found to be insufficient, 
then the multiplicative constants may be adjusted and а new marked waveform w(t) 
produced and tested. 

In the decoder, once the maximum correlation codeword has been detected from 
the marked signal or noise waveform, candidate orthogonal, or near orthogonal code- 
words, are generated from the maximum correlation codeword and these codewords 
are cross correlated with the marked signal or noise waveform in order to determine 
which weighted orthogonal, or near orthogonal, codewords have been added to the 
marked signal or noise waveform. In turn the detected orthogonal, or near orthogonal, 
codewords from the cross correlation coefficients are used to determine the additional 
information which was impressed on the marked signal or noise waveform. 

In order to clarify the description, Fig. 20.4 shows a block diagram of the encoder 
for the example of a system conveying two information bits. The independent signal 
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Fig. 20.4 Encoder for two information bits using near orthogonal codewords 
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Fig. 20.5 Decoder for marked waveform containing orthogonal codewords 


or noise is input to a buffer memory which feeds a maximum correlation decoder, 
which usually will be a modified Dorsch decoder. The maximum correlation decoder 
has as input the error-correcting code parameters (и, k, din) and the code partition 
information. In this case the partition information is used to partition the codewords 
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into four classes. The codewords, in each class, having highest correlation, and their 
correlation values are output as shown in Fig. 20.4. From the input data and these 
correlation values, the multiplicative constants are determined. The coefficients of 
each codeword are weighted by these constants, and added to the stored independent 
signal or noise to produce the marked waveform, which is output from the encoder. 

Figure 20.5 shows a block diagram of the corresponding decoder. The marked 
waveform is input to the buffer memory which feeds a maximum correlation decoder. 
The error-correcting code parameters of the same (n, k, dinin) code and the code par- 
tition information are also input to the maximum correlation decoder. The codeword 
with the highest correlation is determined. The class in which the codeword resides 
18 found and the two bits of data identifying this class are output from the decoder. 

Ina further approach, additional information may be conveyed by adding weighted 
codewords to the marked signal or noise waveform such that these codewords are 
orthogonal, or near orthogonal, to the codeword having maximum correlation with 
the marked signal or noise waveform. 


20.3 Summary 


This chapter has described how error-correcting codes can be used to impress addi- 
tional information onto waveforms with a minimal level of distortion. Applications 
include watermarking and steganography. A method has been described in which 
the modified Dorsch decoder of Chap. 15 is used to find codewords from partitioned 
classes of codewords, whose waveforms may be used as a watermark which is almost 
invisible, and still be reliably detected. 
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